- Update to 1.20.2 - Rebuild to update libqmi's libqrtr support (rh #2032807) - Include libqrtr-glib build dependency (rh #1996716) - Upgrade to 1.18.2 - Update to 1.18.0 - depend ModemManager on polkit package (rh #1995186) - enable polkit support to allow normal users to access modems (rh #1995186) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.20.2 - Rebuild to update libqmi's libqrtr support (rh #2032807) - Include libqrtr-glib build dependency (rh #1996716) - Upgrade to 1.18.2 - Update to 1.18.0 - depend ModemManager on polkit package (rh #1995186) - enable polkit support to allow normal users to access modems (rh #1995186) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Update to 1.53.3 (dev) - Add more IPv6 prefix delegation options (RHEL-85765) - Fix order of parsing port/controller properties in nmcli (RHEL-85767) - Improve interface activation logic (RHEL-85766) - Fix WireGuard IPv6 firewall rules (RHEL-85763) - Support OVS-DPDK dpdk-lsc-interrupt and mtu_request configurations (RHEL-77148) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Fix CVE-2026-10805 (RHEL-191624) - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Update to 1.53.3 (dev) - Add more IPv6 prefix delegation options (RHEL-85765) - Fix order of parsing port/controller properties in nmcli (RHEL-85767) - Improve interface activation logic (RHEL-85766) - Fix WireGuard IPv6 firewall rules (RHEL-85763) - Support OVS-DPDK dpdk-lsc-interrupt and mtu_request configurations (RHEL-77148) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Fix CVE-2026-10805 (RHEL-191624) - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Update to 1.53.3 (dev) - Add more IPv6 prefix delegation options (RHEL-85765) - Fix order of parsing port/controller properties in nmcli (RHEL-85767) - Improve interface activation logic (RHEL-85766) - Fix WireGuard IPv6 firewall rules (RHEL-85763) - Support OVS-DPDK dpdk-lsc-interrupt and mtu_request configurations (RHEL-77148) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Fix CVE-2026-10805 (RHEL-191624) - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Update to 1.53.3 (dev) - Add more IPv6 prefix delegation options (RHEL-85765) - Fix order of parsing port/controller properties in nmcli (RHEL-85767) - Improve interface activation logic (RHEL-85766) - Fix WireGuard IPv6 firewall rules (RHEL-85763) - Support OVS-DPDK dpdk-lsc-interrupt and mtu_request configurations (RHEL-77148) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Fix CVE-2026-10805 (RHEL-191624) - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Update to 1.53.3 (dev) - Add more IPv6 prefix delegation options (RHEL-85765) - Fix order of parsing port/controller properties in nmcli (RHEL-85767) - Improve interface activation logic (RHEL-85766) - Fix WireGuard IPv6 firewall rules (RHEL-85763) - Support OVS-DPDK dpdk-lsc-interrupt and mtu_request configurations (RHEL-77148) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Fix CVE-2026-10805 (RHEL-191624) - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Update to 1.53.3 (dev) - Add more IPv6 prefix delegation options (RHEL-85765) - Fix order of parsing port/controller properties in nmcli (RHEL-85767) - Improve interface activation logic (RHEL-85766) - Fix WireGuard IPv6 firewall rules (RHEL-85763) - Support OVS-DPDK dpdk-lsc-interrupt and mtu_request configurations (RHEL-77148) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Fix CVE-2026-10805 (RHEL-191624) - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Update to 1.53.3 (dev) - Add more IPv6 prefix delegation options (RHEL-85765) - Fix order of parsing port/controller properties in nmcli (RHEL-85767) - Improve interface activation logic (RHEL-85766) - Fix WireGuard IPv6 firewall rules (RHEL-85763) - Support OVS-DPDK dpdk-lsc-interrupt and mtu_request configurations (RHEL-77148) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Fix CVE-2026-10805 (RHEL-191624) - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Update to 1.53.3 (dev) - Add more IPv6 prefix delegation options (RHEL-85765) - Fix order of parsing port/controller properties in nmcli (RHEL-85767) - Improve interface activation logic (RHEL-85766) - Fix WireGuard IPv6 firewall rules (RHEL-85763) - Support OVS-DPDK dpdk-lsc-interrupt and mtu_request configurations (RHEL-77148) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Fix CVE-2026-10805 (RHEL-191624) - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Update to 1.53.3 (dev) - Add more IPv6 prefix delegation options (RHEL-85765) - Fix order of parsing port/controller properties in nmcli (RHEL-85767) - Improve interface activation logic (RHEL-85766) - Fix WireGuard IPv6 firewall rules (RHEL-85763) - Support OVS-DPDK dpdk-lsc-interrupt and mtu_request configurations (RHEL-77148) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Fix CVE-2026-10805 (RHEL-191624) - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Update to 1.53.3 (dev) - Add more IPv6 prefix delegation options (RHEL-85765) - Fix order of parsing port/controller properties in nmcli (RHEL-85767) - Improve interface activation logic (RHEL-85766) - Fix WireGuard IPv6 firewall rules (RHEL-85763) - Support OVS-DPDK dpdk-lsc-interrupt and mtu_request configurations (RHEL-77148) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83061) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-85770) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168) Resolves: RHEL-83061 Resolves: RHEL-59083 Resolves: RHEL-87596 Resolves: RHEL-85770 Resolves: RHEL-85764 Resolves: RHEL-85778 Resolves: RHEL-87168 - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-93108) - Crash on _l3cfg_notify_cb (RHEL-92314) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Fix CVE-2026-10805 (RHEL-191624) - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-182629) - Fix 802.1x auth for bridge interface (RHEL-151941) - Add hard dependency on iputils (RHEL-134751) - Update to 1.54.3 - Fix CVE-2025-9615 (RHEL-111783) - Update to 1.54.2 - Support setting protocol version of HSR/PRP (RHEL-122172) - Support interlink for HSR/PRP (RHEL-122175) - Improve logging of networking off (RHEL-122173 ) - Don't delete unrelated OVS ports (RHEL-121104) - Update to 1.54.1 - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954) - Fix connection.autoconnect-ports of OVS ports (RHEL-114200) - Global DNS config without domains silently ignored from D-Bus (RHEL-115973) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102743) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102772) - Allow setting IP method to disabled in port connection (RHEL-102768) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728) - Fix a race condition in ovs tun interface (RHEL-98551) - preserve failed setfacl return code (RHEL-11833) - rebase to 2.4.0 to fix the following CVEs: - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions (RHEL-186111) - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl (RHEL-186216) - Backport 19b11f91660b ("Add the subtable CFMWS to the CEDT table"). - Backport d9798f5275bb ("Fix Compile issue with CEDT and add template"). - Backport 0914618b553d ("Automated cleanup; No functional changes"). - Backport 7021087eedb0 ("Remove a duplicate of ACPI_SIG_CEDT"). - Add in big-endian patch for CEDT tble. - Add in big-endian patches for PRMT, RGRT and SVKL tables. - Fix big-endian related prmt.asl compiler errors. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Running 'iasl -T all' would segfault when dumping the PHAT template; fixed AcpiDmDumpPhat() by removing unnecessary assignments from patch - Borrowed a patch from upstream to fix Unicode usage in WPBTs - Update to 20210604 source tree. - Bring the big-endian patches up-to-date with what has been submitted upstream by Al Stone <ahs3@redhat.com> (not accepted currently). - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 20200925 source tree - Completely revamp the old big-endian patches (maintainability was the goal). This results in a much larger patch set, but each patch is more clearly used for a specific purpose. - The acpinames command has been deprecated upstream; acpiexec provides replacement functionality. - Fix issue with restoring SELinux file label Resolves: RHEL-134944 - Add explicit selinux dependencies to avoid policycoreutils-python-utils dependency Resolves: RHEL-134944 - Rebase to latest upstream version Resolves: RHEL-134944 Resolves: RHEL-134945 Resolves: RHEL-134946 Resolves: RHEL-134947 Resolves: RHEL-134948 Resolves: RHEL-134950 Resolves: RHEL-134951 Resolves: RHEL-134952 - Fix issue with restoring SELinux file label Resolves: RHEL-134944 - Add explicit selinux dependencies to avoid policycoreutils-python-utils dependency Resolves: RHEL-134944 - Rebase to latest upstream version Resolves: RHEL-134944 Resolves: RHEL-134945 Resolves: RHEL-134946 Resolves: RHEL-134947 Resolves: RHEL-134948 Resolves: RHEL-134950 Resolves: RHEL-134951 Resolves: RHEL-134952 - Rebuilt to make sure moving this package to AppStream. Resolves: rhbz#2094195 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - 9.8 stable - 9.8 beta - 9.7 stable - 9.7 beta - 9.6 stable - 9.6 beta - Update AlmaLinux Secure Boot certificate - 9.5 stable - 9.8 stable - 9.8 beta - 9.7 stable - 9.7 beta - 9.6 stable - 9.6 beta - Update AlmaLinux Secure Boot certificate - 9.5 stable - 9.8 stable - 9.8 beta - 9.7 stable - 9.7 beta - 9.6 stable - 9.6 beta - Update AlmaLinux Secure Boot certificate - 9.5 stable - ostree: move admindir to /etc/alternatives.admindir (RHEL-57665) - ci: fix `NEXT_VERSION` in Makefile - revert: releng: Enable Packit to handle Fedora updates - revert: releng: Convert to rpmautospec - Translated using Weblate (Korean) - Translated using Weblate (English (United Kingdom)) - alternatives: --keep-foreign incorrectly handles non-existent files - alternatives: isLink should return 0 in case of lstat error - Translated using Weblate (Swedish) - Translated using Weblate (Korean) - Translated using Weblate (Georgian) - Translated using Weblate (Finnish) - Translated using Weblate (Ukrainian) - Translated using Weblate (Polish) - Update translation files - Translated using Weblate (German) - doc: update translations - spec: remote changelog - migrate to SPDX license - Translated using Weblate (English (United Kingdom)) - Translated using Weblate (Japanese) - ci: Add locale linter - ci: update workflows - test: fix ShellCheck error[SC2070] - Bump redhat-plumbers-in-action/differential-shellcheck from 3 to 4 (#94) - releng: Packit remove extra job trigger - releng: Enable Packit to handle Fedora updates - releng: Convert to rpmautospec - ci: Add CodeQL to replace LGTM - alternatives: replace master/slave with leader/follower - chkconfig: use correct cmp function - Bump redhat-plumbers-in-action/differential-shellcheck from 2 to 3 - ci: Add Shell linter - Differential ShellCheck - ci: Use more inclusive terminology in workflows - ci: Update workflows, packit and dependabot - Translated using Weblate (Friulian) - Translated using Weblate (Swedish) - Translated using Weblate (Estonian) - Translated using Weblate (Georgian) - Translated using Weblate (Polish) - Translated using Weblate (Korean) - Translated using Weblate (Czech) - Translations update from Fedora Weblate (#77) - Translations update from Fedora Weblate (#75) - Translations update from Fedora Weblate (#74) - Translations update from Fedora Weblate (#73) - Translated using Weblate (Ukrainian) - Update translation files - Family mentioned for --set in both man and help - Translated using Weblate (French) - build-sys: Ensure `systemd-sysv-install` symlink does not have `//` - Translated using Weblate (German) - Add LGTM badges to README - Merge remote-tracking branch 'weblate/master' - Translated using Weblate (Indonesian) - Translated using Weblate (Finnish) - Translated using Weblate (Korean) - Translated using Weblate (Ukrainian) - Translated using Weblate (Turkish) - Translated using Weblate (Polish) - Translated using Weblate (Norwegian Nynorsk) - Update translation files - Translated using Weblate (Finnish) - Translated using Weblate (Czech) - Translated using Weblate (Swedish) - Translated using Weblate (Italian) - Translated using Weblate (Spanish) - Translated using Weblate (Chinese (Simplified)) - Use systemd-tmpfiles for /var/spool/at directories - Resolves: RHEL-110319 - Add patch to fix past date handling - Resolves: RHEL-97024 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Remove unused scriptlets - Fix the messed scriptlets Resolves: #1929845 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Sync with rhel 8.3 + cleanup - Add new subpackages - z{14,15} - Unlike in rhel8, the base subpackage still needs to be build for z12. - Covscan related bugfixes - Spec and git cleanup (remove unused patches/sources) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Drop IBM z10 and z196 subpackages - s390 is now optimized for z12 Related: #1780286 - Fix compatibility with gcc 10 - Sync compiler/linker flags with RHEL - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - new upstream release - new upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - add BR for perl(FileHandle) needed by %check - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - rebase to 2.6.0 to fix the following CVEs: - CVE-2026-54371 - Symlink Traversal Privilege Escalation via getfattr (RHEL-186121) - Fix POSTIN scriplet to not fail during upgrade Resolves: RHEL-138696 - ausearch-checkpoint race condition fix Resolves: RHEL-86897 - Update end of event detection mechanism Resolves: RHEL-78323 - ausearch: correct search for DAEMON related events - allow hex digits when interpreting tty data Resolves: RHEL-82279 - Fix TTY hostname in log messages Resolves: RHEL-78323 - auditctl: correct buffer in filter_supported_syscalls to avoid overflow Resolves: RHEL-59585 - Don't do "live" operations during rpm-ostree composes Resolves: RHEL-69033 - Disable ProtectKernelModules=true in service file Resolves: RHEL-59570 - af_unix plugin: restore original behavior in binary mode Resolves: RHEL-59585 - Support image mode Resolves: RHEL-69033 - Resolve ordering cycle when using remote logging Resolves: RHEL-11252 - Filter syscalls to ensure architecture-specific availability Resolves: RHEL-70455 - New upstream maintenance release, 3.1.4 - Prevent scriplets from failing - When upgrading, restart the daemon if it's running - If uninstalling, stop the daemon - auditctl: use pidfd_send_signal for signaling auditd Resolves: RHEL-45865 - Minor doc update Resolves: RHEL-5186 - augenrules: do not exit with failure if in immutable mode Resolves: RHEL-40110 - auditd.service: Disable ProtectControlGroups Resolves: RHEL-5197 - auditctl: correct output when displaying rules with exe/path/dir Resolves: RHEL-40243 - Fix POSTIN scriplet to not fail during upgrade Resolves: RHEL-138696 - ausearch-checkpoint race condition fix Resolves: RHEL-86897 - Update end of event detection mechanism Resolves: RHEL-78323 - ausearch: correct search for DAEMON related events - allow hex digits when interpreting tty data Resolves: RHEL-82279 - Fix TTY hostname in log messages Resolves: RHEL-78323 - auditctl: correct buffer in filter_supported_syscalls to avoid overflow Resolves: RHEL-59585 - Don't do "live" operations during rpm-ostree composes Resolves: RHEL-69033 - Disable ProtectKernelModules=true in service file Resolves: RHEL-59570 - af_unix plugin: restore original behavior in binary mode Resolves: RHEL-59585 - Support image mode Resolves: RHEL-69033 - Resolve ordering cycle when using remote logging Resolves: RHEL-11252 - Filter syscalls to ensure architecture-specific availability Resolves: RHEL-70455 - New upstream maintenance release, 3.1.4 - Prevent scriplets from failing - When upgrading, restart the daemon if it's running - If uninstalling, stop the daemon - auditctl: use pidfd_send_signal for signaling auditd Resolves: RHEL-45865 - Minor doc update Resolves: RHEL-5186 - augenrules: do not exit with failure if in immutable mode Resolves: RHEL-40110 - auditd.service: Disable ProtectControlGroups Resolves: RHEL-5197 - auditctl: correct output when displaying rules with exe/path/dir Resolves: RHEL-40243 - Fix POSTIN scriplet to not fail during upgrade Resolves: RHEL-138696 - ausearch-checkpoint race condition fix Resolves: RHEL-86897 - Update end of event detection mechanism Resolves: RHEL-78323 - ausearch: correct search for DAEMON related events - allow hex digits when interpreting tty data Resolves: RHEL-82279 - Fix TTY hostname in log messages Resolves: RHEL-78323 - auditctl: correct buffer in filter_supported_syscalls to avoid overflow Resolves: RHEL-59585 - Don't do "live" operations during rpm-ostree composes Resolves: RHEL-69033 - Disable ProtectKernelModules=true in service file Resolves: RHEL-59570 - af_unix plugin: restore original behavior in binary mode Resolves: RHEL-59585 - Support image mode Resolves: RHEL-69033 - Resolve ordering cycle when using remote logging Resolves: RHEL-11252 - Filter syscalls to ensure architecture-specific availability Resolves: RHEL-70455 - New upstream maintenance release, 3.1.4 - Prevent scriplets from failing - When upgrading, restart the daemon if it's running - If uninstalling, stop the daemon - auditctl: use pidfd_send_signal for signaling auditd Resolves: RHEL-45865 - Minor doc update Resolves: RHEL-5186 - augenrules: do not exit with failure if in immutable mode Resolves: RHEL-40110 - auditd.service: Disable ProtectControlGroups Resolves: RHEL-5197 - auditctl: correct output when displaying rules with exe/path/dir Resolves: RHEL-40243 - Fix POSTIN scriplet to not fail during upgrade Resolves: RHEL-138696 - ausearch-checkpoint race condition fix Resolves: RHEL-86897 - Update end of event detection mechanism Resolves: RHEL-78323 - ausearch: correct search for DAEMON related events - allow hex digits when interpreting tty data Resolves: RHEL-82279 - Fix TTY hostname in log messages Resolves: RHEL-78323 - auditctl: correct buffer in filter_supported_syscalls to avoid overflow Resolves: RHEL-59585 - Don't do "live" operations during rpm-ostree composes Resolves: RHEL-69033 - Disable ProtectKernelModules=true in service file Resolves: RHEL-59570 - af_unix plugin: restore original behavior in binary mode Resolves: RHEL-59585 - Support image mode Resolves: RHEL-69033 - Resolve ordering cycle when using remote logging Resolves: RHEL-11252 - Filter syscalls to ensure architecture-specific availability Resolves: RHEL-70455 - New upstream maintenance release, 3.1.4 - Prevent scriplets from failing - When upgrading, restart the daemon if it's running - If uninstalling, stop the daemon - auditctl: use pidfd_send_signal for signaling auditd Resolves: RHEL-45865 - Minor doc update Resolves: RHEL-5186 - augenrules: do not exit with failure if in immutable mode Resolves: RHEL-40110 - auditd.service: Disable ProtectControlGroups Resolves: RHEL-5197 - auditctl: correct output when displaying rules with exe/path/dir Resolves: RHEL-40243 - Support group merging in nsswitch.conf (RHEL-15779) - Fix Japanese translations (RHBZ #2153364) - Update translations (RHBZ #2189498) - Do not prompt for password twice when changing password of local user (RHBZ #2228098) - Support group merging in nsswitch.conf (RHEL-15779) - Fix Japanese translations (RHBZ #2153364) - Update translations (RHBZ #2189498) - Do not prompt for password twice when changing password of local user (RHBZ #2228098) - RHEL-85615 - autofs fails to mount shares when using kerberised LDAP - always recreate credential cache. - fix always recreate credential cache. -Resolves: RHEL-85615 - RHEL-81885 - autofs: segfault while dereferencing null mapent - fix handling of ignored offsets. - fix invalidated map entry handling in hosts module. - fix changelog revision number of previous change. - Resolves: RHEL-81885 - RHEL-87031 - autofs hang - autofs-5.1.4-114.el8_10.2 - fix lock ordering deadlock in expire_cleanup(). - change spec file %patchN to %patch -P N as required by rpm(8). - Fix compile error caused by function pointer types in cyrus-sasl module. - removed references to patch1 and patch2 due to rbmbuild(8) complaints. - Resolves: RHEL-87031 - RHEL-32684 - sssd autofs fails to get correct EHOSTDOWN if requested incorrect mount after upgrade to sssd-2.9.1-4.el8_9.5.x86_64 - handle sss special case getautomntbyname() error - Resolves: RHEL-32684 - RHEL-77321 - autofs: deadlock between mnts_lookup_mount and mnts_remove_mount - fix deadlock in master_notify_submount(). - Resolves: RHEL-77321 - RHEL-69485 - Sporadic mount failures with amd program maps on RHEL8 - fix amd external mount error handling. - fix amd external mount mount handling. - don't free ext mount if mounted. - refactor amd function do_program_mount(). - refactor umount_amd_ext_mount(). - add flags argument to amd do_program_mount(). - Resolves: RHEL-69485 - RHEL-71359 RFE: autofs: add handling for AMD 'nounmount' option - fix amd cache options not copied. - seperate amd mount and entry flags. - make iocl ops ->timeout() handle per-dentry expire. - refactor amd mount options handling. - add some unimplemented amd map options. - fix lookup search type in umount_subtree_mounts(). - fix remount_active_mount() not remounting symlinks. - log when setting amd per-mount timeout. - update per-mount expire timeout on readmap. - clear per-mount timeout if not set. - Resolves: RHEL-71359 - RHEL-57466 - RHEL9.4 - autofs crashes on startup after IDM client configuration - fix submount shutdown race. - Resolves: RHEL-57466 - RHEL-19731 - SIGSEGV using hierarchical map entries on reload with autofs-5.1.4-109 - fix get parent multi-mount check in try_remount(). - fix deadlock in remount. - Resolves: RHEL-19731 - RHEL-13084 - multi mount detection fails for share with blank+dash causing SEGV crash - fix multi-mount check. - Resolves: RHEL-13084 - RHEL-13083 - autofs attempts to mount nonexistant ".hidden" filesystems - allow -null map in indirect maps. - Resolves: RHEL-13083 - bz2223252 - filesystems mount and expire immediately - fix expire retry looping. - correct day in changelog entry for revision 53. - Resolves: rhbz#2223252 - Rebuild to fix missing binaries due to buildsystem oversight - RHEL-158216 - get_proximity returns a worng proximity on specific addresses [rhel-9.8.z] - Fix masks in parse_sub.c, so that hosts are correctly matched. - Resolves: RHEL-158216 - RHEL-154192 - Wrong oz_pgrp in autofs_sb_info causes automount to wait on automount. - quiet possibly noisy log message. - fix devid update on reload. - fix cache writelock must be taken in update_map_cache(). - fix skip valid map entries on expire cleanup. - remove unnecessary call to set_direct_mount_tree_catatonic(). - remove unnecessary assignment in umount_multi(). - fix direct mount trigger umount failure case. - refactor do_umount_autofs_direct(). - fix stale direct mount trigger not umounted on expire. - add function table_lookup_ino(). - improve handling of missing map entry for mount request. - Resolves: RHEL-154192 - RHEL-85615 - autofs fails to mount shares when using kerberised LDAP - always recreate credential cache. - fix always recreate credential cache. -Resolves: RHEL-85615 - RHEL-81885 - autofs: segfault while dereferencing null mapent - fix handling of ignored offsets. - fix invalidated map entry handling in hosts module. - fix changelog revision number of previous change. - Resolves: RHEL-81885 - RHEL-87031 - autofs hang - autofs-5.1.4-114.el8_10.2 - fix lock ordering deadlock in expire_cleanup(). - change spec file %patchN to %patch -P N as required by rpm(8). - Fix compile error caused by function pointer types in cyrus-sasl module. - removed references to patch1 and patch2 due to rbmbuild(8) complaints. - Resolves: RHEL-87031 - RHEL-32684 - sssd autofs fails to get correct EHOSTDOWN if requested incorrect mount after upgrade to sssd-2.9.1-4.el8_9.5.x86_64 - handle sss special case getautomntbyname() error - Resolves: RHEL-32684 - RHEL-77321 - autofs: deadlock between mnts_lookup_mount and mnts_remove_mount - fix deadlock in master_notify_submount(). - Resolves: RHEL-77321 - RHEL-69485 - Sporadic mount failures with amd program maps on RHEL8 - fix amd external mount error handling. - fix amd external mount mount handling. - don't free ext mount if mounted. - refactor amd function do_program_mount(). - refactor umount_amd_ext_mount(). - add flags argument to amd do_program_mount(). - Resolves: RHEL-69485 - RHEL-71359 RFE: autofs: add handling for AMD 'nounmount' option - fix amd cache options not copied. - seperate amd mount and entry flags. - make iocl ops ->timeout() handle per-dentry expire. - refactor amd mount options handling. - add some unimplemented amd map options. - fix lookup search type in umount_subtree_mounts(). - fix remount_active_mount() not remounting symlinks. - log when setting amd per-mount timeout. - update per-mount expire timeout on readmap. - clear per-mount timeout if not set. - Resolves: RHEL-71359 - RHEL-57466 - RHEL9.4 - autofs crashes on startup after IDM client configuration - fix submount shutdown race. - Resolves: RHEL-57466 - Fix CVE-2024-52615 (RHEL-94846) - Fix CVE-2024-52616 (RHEL-67722) - fix file attributes on /run/avahi-daemon (RHEL-5633) - avahi-client: fix resource leak (RHEL-27722) - fix resource leak in avahi_time_event_queue_new (RHEL-27717) - Fix CVE-2024-52615 (RHEL-94846) - Fix CVE-2024-52616 (RHEL-67722) - fix file attributes on /run/avahi-daemon (RHEL-5633) - avahi-client: fix resource leak (RHEL-27722) - fix resource leak in avahi_time_event_queue_new (RHEL-27717) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix a performance regression while using large number of environment variables Resolves: RHEL-20020 - Fix an issue with adding newline in bracketed paste mode Resolves: #2168963 - Restore audit logs in bash-4.3 or newer versions Resolves: RHEL-22619 - Add a null check in parameter_brace_transform() function Resolves: CVE-2022-3715 - Fix an off by one error while calling mbrtowc() Resolves: #2115206 - Remove bash completions for javaws Resolves: RHEL-5650 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix a potential illegal memory access when copying a corrupt input file. (RHEL-142281) - Fix a potential illegal memory access when copying a corrupt input file. (RHEL-132287) - Fix a potential illegal memory access when linking a corrupt input file. (RHEL-126883) - Add missing space to ppc476-shared2 linker test. (RHEL-113842) - Adds tests for the linker's --error-execstack and --error-rwx-segments command line options. (RHEL-109970) - Add missing tests of AArch64 instructions to the assembler testsuite. (RHEL-104630) - NVR bump to allow rebuilding for RHEL-9.7 (RHEL-87216) - Adds z17 as a cpu name for the s390x architecture. (RHEL-87216) - Fix seg-fault in AArch64 linker when building u-boot. (RHEL-78350) - Retire: binutils-rhivos-segment-gap.patch. (RHEL-60807) - Fix a potential illegal memory access when copying a corrupt input file. (RHEL-142281) - Fix a potential illegal memory access when copying a corrupt input file. (RHEL-132287) - Fix a potential illegal memory access when linking a corrupt input file. (RHEL-126883) - Add missing space to ppc476-shared2 linker test. (RHEL-113842) - Adds tests for the linker's --error-execstack and --error-rwx-segments command line options. (RHEL-109970) - Add missing tests of AArch64 instructions to the assembler testsuite. (RHEL-104630) - NVR bump to allow rebuilding for RHEL-9.7 (RHEL-87216) - Adds z17 as a cpu name for the s390x architecture. (RHEL-87216) - Fix seg-fault in AArch64 linker when building u-boot. (RHEL-78350) - Retire: binutils-rhivos-segment-gap.patch. (RHEL-60807) - Update to 5.85 Resolves: RHEL-142552 - Fix problem with menu handling Resolves: RHEL-103966 - Update to 5.83 Resolves: RHEL-94819 Resolves: RHEL-56073 Resolves: RHEL-1924 - Fix plugin_init() startup warnings Related: RHEL-68934 - Fix ConfigurationDirectory startup warning Related: RHEL-71798 - Bump release to rebuild for RHEL-9.5 - Update to 5.72 - Update to 5.87 post-release snapshot Resolves: RHEL-193095 - Update to 5.87 pre-release snapshot Resolves: RHEL-169988 - Fix startup warning Resolves: RHEL-161518 - Update to 5.86 - Re-add btmgmt as it does not require bluetoothd to be running, unlike bluetoothctl mgmt - Fix audio output not working in some circumstances Resolves: RHEL-147734 - Update to 5.85 Resolves: RHEL-142552 - Fix problem with menu handling Resolves: RHEL-103966 - Update to 5.83 Resolves: RHEL-94819 Resolves: RHEL-56073 Resolves: RHEL-1924 - Fix plugin_init() startup warnings Related: RHEL-68934 - Fix ConfigurationDirectory startup warning Related: RHEL-71798 - Update to 5.85 Resolves: RHEL-142552 - Fix problem with menu handling Resolves: RHEL-103966 - Update to 5.83 Resolves: RHEL-94819 Resolves: RHEL-56073 Resolves: RHEL-1924 - Fix plugin_init() startup warnings Related: RHEL-68934 - Fix ConfigurationDirectory startup warning Related: RHEL-71798 - Bump release to rebuild for RHEL-9.5 - Update to 5.72 - Update to 5.87 post-release snapshot Resolves: RHEL-193095 - Update to 5.87 pre-release snapshot Resolves: RHEL-169988 - Fix startup warning Resolves: RHEL-161518 - Update to 5.86 - Re-add btmgmt as it does not require bluetoothd to be running, unlike bluetoothctl mgmt - Fix audio output not working in some circumstances Resolves: RHEL-147734 - Update to 5.85 Resolves: RHEL-142552 - Fix problem with menu handling Resolves: RHEL-103966 - Update to 5.83 Resolves: RHEL-94819 Resolves: RHEL-56073 Resolves: RHEL-1924 - Fix plugin_init() startup warnings Related: RHEL-68934 - Fix ConfigurationDirectory startup warning Related: RHEL-71798 - Update to the upstream version 0.9.10 - Update to 0.9.10 - Fix bolt exits when opening an empty version file - Fix a NULL syspath variable causes SIGSEGV - Update to upstream release 0.9.7 - Support 'nopcie' security level - Rebase to 0.6.3 which is supported upstream This release also includes the fix for CVE-2024-42472 Fixes: #RHEL-56797 - Backport upstream fix to help address CVE-2024-42472 in flatpak - Backport https://github.com/containers/bubblewrap/commit/4c35d7a5f92499d6ed646d4a5ffad9acc10cb432 - Fix CVE-2026-87766 path traversal through symlinked mount targets - Use O_PATH for parent directory traversal during setup - Resolves: RHEL-256871 - Add the explicit Rquires to the base package Resolves: RHEL-138675 - Revert the previous commit (introduced a regression) Resolves: CVE-2019-12900 - Fix out of bounds access in BZ2_decompress Resolves: RHEL-65198 - Add the explicit Rquires to the base package Resolves: RHEL-138675 - Revert the previous commit (introduced a regression) Resolves: CVE-2019-12900 - Fix out of bounds access in BZ2_decompress Resolves: RHEL-65198 - Resolves: RHEL-26529 - Out of bounds read in ares__read_line() [rhel-9] - Resolves: rhbz#2209564 - CVE-2023-31124 c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation [rhel-9] - Resolves: rhbz#2209556 - CVE-2023-31130 c-ares: Buffer Underwrite in ares_inet_net_pton() [rhel-9] - Resolves: rhbz#2209550 - CVE-2023-31147 c-ares: Insufficient randomness in generation of DNS query IDs [rhel-9] - Resolves: rhbz#2209520 - CVE-2023-32067 c-ares: 0-byte UDP payload Denial of Service [rhel-9.3.0] - Resolves: rhbz#2210370 - Rebase c-ares for RHEL 9.3 - Resolves: rhbz#2170868 - c-ares: buffer overflow in config_sortlist() due to missing string length check [rhel-9] - Update to CKBI 2.80_v9.0.305 from NSS 3.114 - Adding: - # Certificate "TWCA CYBER Root CA" - # Certificate "TWCA Global Root CA G2" - # Certificate "SecureSign Root CA12" - # Certificate "SecureSign Root CA14" - # Certificate "SecureSign Root CA15" - # Certificate "D-TRUST BR Root CA 2 2023" - # Certificate "TrustAsia SMIME ECC Root CA" - # Certificate "TrustAsia SMIME RSA Root CA" - # Certificate "TrustAsia TLS ECC Root CA" - # Certificate "TrustAsia TLS RSA Root CA" - # Certificate "D-TRUST EV Root CA 2 2023" - # Certificate "SwissSign RSA SMIME Root CA 2022 - 1" - # Certificate "SwissSign RSA TLS Root CA 2022 - 1" - # Certificate "Sectigo Public Code Signing Root R46" - # Certificate "Sectigo Public Code Signing Root E46" - Add libffi to required packages - Add finutils explicitly - update-ca-trust: return warnings on a unsupported argument instead of error - Temporarily generate the directory-hash files in %install ...(next item) - Add list of ghost files from directory-hash to %files - Remove write permissions from directory-hash - Reduce dependency on p11-kit to only the trust subpackage - Own the Directory-hash directory - Fix release number - Update to CKBI 2.69_v8.0.303 from NSS 3.101.1 - GLOBALTRUST 2020 root CA certificate set CKA_NSS_{SERVER|EMAIL}_DISTRUST_AFTER - Update to CKBI 2.68_v8.0.302 from NSS 3.101 - Removing: - # Certificate "Verisign Class 1 Public Primary Certification Authority - G3" - # Certificate "Verisign Class 2 Public Primary Certification Authority - G3" - # Certificate "Security Communication Root CA" - # Certificate "Camerfirma Chambers of Commerce Root" - # Certificate "Hongkong Post Root CA 1" - # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068" - # Certificate "Symantec Class 1 Public Primary Certification Authority - G6" - # Certificate "Symantec Class 2 Public Primary Certification Authority - G6" - # Certificate "TrustCor RootCert CA-1" - # Certificate "TrustCor RootCert CA-2" - # Certificate "TrustCor ECA-1" - # Certificate "FNMT-RCM" - Adding: - # Certificate "LAWtrust Root CA2 (4096)" - # Certificate "Sectigo Public Email Protection Root E46" - # Certificate "Sectigo Public Email Protection Root R46" - # Certificate "Sectigo Public Server Authentication Root E46" - # Certificate "Sectigo Public Server Authentication Root R46" - # Certificate "SSL.com TLS RSA Root CA 2022" - # Certificate "SSL.com TLS ECC Root CA 2022" - # Certificate "SSL.com Client ECC Root CA 2022" - # Certificate "SSL.com Client RSA Root CA 2022" - # Certificate "Atos TrustedRoot Root CA ECC G2 2020" - # Certificate "Atos TrustedRoot Root CA RSA G2 2020" - # Certificate "Atos TrustedRoot Root CA ECC TLS 2021" - # Certificate "Atos TrustedRoot Root CA RSA TLS 2021" - # Certificate "TrustAsia Global Root CA G3" - # Certificate "TrustAsia Global Root CA G4" - # Certificate "CommScope Public Trust ECC Root-01" - # Certificate "CommScope Public Trust ECC Root-02" - # Certificate "CommScope Public Trust RSA Root-01" - # Certificate "CommScope Public Trust RSA Root-02" - # Certificate "D-Trust SBR Root CA 1 2022" - # Certificate "D-Trust SBR Root CA 2 2022" - # Certificate "Telekom Security SMIME ECC Root 2021" - # Certificate "Telekom Security TLS ECC Root 2020" - # Certificate "Telekom Security SMIME RSA Root 2023" - # Certificate "Telekom Security TLS RSA Root 2023" - # Certificate "FIRMAPROFESIONAL CA ROOT-A WEB" - # Certificate "SECOM Trust.net" - # Certificate "Chambers of Commerce Root" - # Certificate "VeriSign Class 2 Public Primary Certification Authority - G3" - # Certificate "SSL.com Code Signing RSA Root CA 2022" - # Certificate "SSL.com Code Signing ECC Root CA 2022" - Fix malformed patch header in remove-emsign-root-cs-ca-g3.patch - Removing: emSign Root CS CA - G3 from Microsoft Code Signing certificates - Removing: AAA Certificate Services root CA - Removing: emSign ECC Root CA - G3 from Microsoft Code Signing certificates - Update to CKBI 2.92_v9.0.319 from NSS 3.131.1 Removing: - emSign Root CA - C1 Adding: - Actalis Code Signing ECC Root CA 2025 - Actalis Code Signing RSA Root CA 2025 - emSign Root CS CA - G2 - emSign Root CS CA - G3 - IdenTrust Commercial Root Code Signing RSA CA 2 - e-Szigno CodeSigning Root CA 2024 - Update to CKBI 2.90_v9.0.316 from NSS 3.126 Removing: - XRamp Global CA Root - ePKI Root Certification Authority - certSIGN ROOT CA - Explicitly Distrust DigiNotar Root CA - CommScope Public Trust ECC Root-01 - CommScope Public Trust ECC Root-02 - CommScope Public Trust RSA Root-01 - CommScope Public Trust RSA Root-02 - FIRMAPROFESIONAL CA ROOT-A WEB - SecureSign Root CA12 Adding: - OISTE Client Root ECC G1 - OISTE Client Root RSA G1 - OISTE Server Root ECC G1 - OISTE Server Root RSA G1 - e-Szigno TLS Root CA 2023 - SecureSign Root CA16 - SECOM TLS RSA Root CA 2024 - SECOM TLS ECC Root CA 2024 - SECOM SMIME RSA Root CA 2024 - Telia EC Email Root CA v3 - Telia EC TLS Root CA v3 - Telia RSA Email Root CA v3 - Telia RSA TLS Root CA v3 - certSIGN - Chunghwa Telecom Co., Ltd. - XRamp Global Certification Authority - Update to CKBI 2.80_v9.0.305 from NSS 3.114 - Adding: - # Certificate "TWCA CYBER Root CA" - # Certificate "TWCA Global Root CA G2" - # Certificate "SecureSign Root CA12" - # Certificate "SecureSign Root CA14" - # Certificate "SecureSign Root CA15" - # Certificate "D-TRUST BR Root CA 2 2023" - # Certificate "TrustAsia SMIME ECC Root CA" - # Certificate "TrustAsia SMIME RSA Root CA" - # Certificate "TrustAsia TLS ECC Root CA" - # Certificate "TrustAsia TLS RSA Root CA" - # Certificate "D-TRUST EV Root CA 2 2023" - # Certificate "SwissSign RSA SMIME Root CA 2022 - 1" - # Certificate "SwissSign RSA TLS Root CA 2022 - 1" - # Certificate "Sectigo Public Code Signing Root R46" - # Certificate "Sectigo Public Code Signing Root E46" - Add libffi to required packages - Add finutils explicitly - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - ostree: move admindir to /etc/alternatives.admindir (RHEL-57665) - ci: fix `NEXT_VERSION` in Makefile - revert: releng: Enable Packit to handle Fedora updates - revert: releng: Convert to rpmautospec - Translated using Weblate (Korean) - Translated using Weblate (English (United Kingdom)) - alternatives: --keep-foreign incorrectly handles non-existent files - alternatives: isLink should return 0 in case of lstat error - Translated using Weblate (Swedish) - Translated using Weblate (Korean) - Translated using Weblate (Georgian) - Translated using Weblate (Finnish) - Translated using Weblate (Ukrainian) - Translated using Weblate (Polish) - Update translation files - Translated using Weblate (German) - doc: update translations - spec: remote changelog - migrate to SPDX license - Translated using Weblate (English (United Kingdom)) - Translated using Weblate (Japanese) - ci: Add locale linter - ci: update workflows - test: fix ShellCheck error[SC2070] - Bump redhat-plumbers-in-action/differential-shellcheck from 3 to 4 (#94) - releng: Packit remove extra job trigger - releng: Enable Packit to handle Fedora updates - releng: Convert to rpmautospec - ci: Add CodeQL to replace LGTM - alternatives: replace master/slave with leader/follower - chkconfig: use correct cmp function - Bump redhat-plumbers-in-action/differential-shellcheck from 2 to 3 - ci: Add Shell linter - Differential ShellCheck - ci: Use more inclusive terminology in workflows - ci: Update workflows, packit and dependabot - Translated using Weblate (Friulian) - Translated using Weblate (Swedish) - Translated using Weblate (Estonian) - Translated using Weblate (Georgian) - Translated using Weblate (Polish) - Translated using Weblate (Korean) - Translated using Weblate (Czech) - Translations update from Fedora Weblate (#77) - Translations update from Fedora Weblate (#75) - Translations update from Fedora Weblate (#74) - Translations update from Fedora Weblate (#73) - Translated using Weblate (Ukrainian) - Update translation files - Family mentioned for --set in both man and help - Translated using Weblate (French) - build-sys: Ensure `systemd-sysv-install` symlink does not have `//` - Translated using Weblate (German) - Add LGTM badges to README - Merge remote-tracking branch 'weblate/master' - Translated using Weblate (Indonesian) - Translated using Weblate (Finnish) - Translated using Weblate (Korean) - Translated using Weblate (Ukrainian) - Translated using Weblate (Turkish) - Translated using Weblate (Polish) - Translated using Weblate (Norwegian Nynorsk) - Update translation files - Translated using Weblate (Finnish) - Translated using Weblate (Czech) - Translated using Weblate (Swedish) - Translated using Weblate (Italian) - Translated using Weblate (Spanish) - Translated using Weblate (Chinese (Simplified)) - update to 4.8 (RHEL-112598 RHEL-107036) - improve description of refresh directive (RHEL-82096) - improve logging of selection failures (RHEL-80388 RHEL-80413 RHEL-80415) - fix sourcedir reloading to not multiply sources (RHEL-95016) - switch from patchX to patch -P X - update to 4.6.1 (RHEL-61877) - keep PHC refclock reachable when dropping samples due to high delay (RHEL-65421) - update to 4.6 (RHEL-56964) - don't repeat error log messages when reloading sourcedir (RHEL-51786) - add support for leap-seconds.list file (RHEL-53484) - fix crash on reload command during start (RHEL-28945) - update to 4.5 (RHEL-6522 RHEL-6520 RHEL-9969 RHEL-9971 RHEL-9973 RHEL-9975 RHEL-12411) - add chronyd-restricted service (RHEL-9972) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use autosetup and enable testsuite - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - resolves: RHEL-146305 - Enable debug logs in cifs.upcall - resolves: RHEL-131406 - fix regression with cifscreds(1) - resolves: RHEL-82680 - Update to version 7.2 - Fix damaged test filename - resolves: RHEL-61732 - Update to version 7.1 - Implement CLDAP Ping to find the closest site - Resolves: RHELPLAN-17597 - mount.cifs.rst: add missing reference for sssd - mount.cifs.rst: update section about xattr/acl support - Resolves: RHEL-22495 - pam_cifscreds: fix NULL arg warning passed to pam_syslog() - Resolves: RHEL-28050 - cifs.upcall: fix UAF in get_cachename_from_process_env() - Resolves: RHEL-28047 - resolves: RHEL-192982 - fix krb5 mount regression - Update to version 7.6 - resolves: RHEL-185761 - CVE-2026-12505 cifs-utils: LPE via cifs.spnego - resolves: RHEL-127499 - Enable debug logs in cifs.upcall - resolves: RHEL-110765 - fix regression with cifscreds(1) - resolves: RHEL-82680 - Update to version 7.2 - Fix damaged test filename - resolves: RHEL-61732 - Update to version 7.1 - resolves: RHEL-247580 - fix krb5 regression with --trust-dns - resolves: RHEL-192982 - fix krb5 mount regression - Update to version 7.6 - resolves: RHEL-185761 - CVE-2026-12505 cifs-utils: LPE via cifs.spnego - resolves: RHEL-127499 - Enable debug logs in cifs.upcall - resolves: RHEL-110765 - fix regression with cifscreds(1) - resolves: RHEL-82680 - Update to version 7.2 - Fix damaged test filename - resolves: RHEL-61732 - Update to version 7.1 - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - Package manifests: Add `any` test - Bug fixes and translation updates - Bug fixes and translation updates - ws: Prevent remote code execution with SSH argument injection (RHEL-158310) - node: update lodash dependency (RHEL-164196) - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - Package manifests: Add `any` test - Bug fixes and translation updates - ws: Prevent remote code execution with SSH argument injection (RHEL-158310) - node: update lodash dependency (RHEL-164196) - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - Package manifests: Add `any` test - Bug fixes and translation updates - sosreport: Provide encryption pass via an env variable (RHEL-220573) - ws: Prevent remote code execution with SSH argument injection (RHEL-158310) - node: update lodash dependency (RHEL-164196) - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - Package manifests: Add `any` test - Bug fixes and translation updates - Bug fixes and translation updates - ws: Prevent remote code execution with SSH argument injection (RHEL-158310) - node: update lodash dependency (RHEL-164196) - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - Package manifests: Add `any` test - Bug fixes and translation updates - ws: Prevent remote code execution with SSH argument injection (RHEL-158310) - node: update lodash dependency (RHEL-164196) - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - Package manifests: Add `any` test - Bug fixes and translation updates - sosreport: Provide encryption pass via an env variable (RHEL-220573) - ws: Prevent remote code execution with SSH argument injection (RHEL-158310) - node: update lodash dependency (RHEL-164196) - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - Package manifests: Add `any` test - Bug fixes and translation updates - Bug fixes and translation updates - ws: Prevent remote code execution with SSH argument injection (RHEL-158310) - node: update lodash dependency (RHEL-164196) - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - Package manifests: Add `any` test - Bug fixes and translation updates - ws: Prevent remote code execution with SSH argument injection (RHEL-158310) - node: update lodash dependency (RHEL-164196) - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - Package manifests: Add `any` test - Bug fixes and translation updates - sosreport: Provide encryption pass via an env variable (RHEL-220573) - ws: Prevent remote code execution with SSH argument injection (RHEL-158310) - node: update lodash dependency (RHEL-164196) - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - Package manifests: Add `any` test - Bug fixes and translation updates - Bug fixes and translation updates - ws: Prevent remote code execution with SSH argument injection (RHEL-158310) - node: update lodash dependency (RHEL-164196) - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - Package manifests: Add `any` test - Bug fixes and translation updates - ws: Prevent remote code execution with SSH argument injection (RHEL-158310) - node: update lodash dependency (RHEL-164196) - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - Package manifests: Add `any` test - Bug fixes and translation updates - sosreport: Provide encryption pass via an env variable (RHEL-220573) - ws: Prevent remote code execution with SSH argument injection (RHEL-158310) - node: update lodash dependency (RHEL-164196) - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - Package manifests: Add `any` test - Bug fixes and translation updates - Bug fixes and translation updates - ws: Prevent remote code execution with SSH argument injection (RHEL-158310) - node: update lodash dependency (RHEL-164196) - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - Package manifests: Add `any` test - Bug fixes and translation updates - ws: Prevent remote code execution with SSH argument injection (RHEL-158310) - node: update lodash dependency (RHEL-164196) - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - Package manifests: Add `any` test - Bug fixes and translation updates - sosreport: Provide encryption pass via an env variable (RHEL-220573) - ws: Prevent remote code execution with SSH argument injection (RHEL-158310) - node: update lodash dependency (RHEL-164196) - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - Package manifests: Add `any` test - Bug fixes and translation updates - Bug fixes and translation updates - ws: Prevent remote code execution with SSH argument injection (RHEL-158310) - node: update lodash dependency (RHEL-164196) - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - Package manifests: Add `any` test - Bug fixes and translation updates - ws: Prevent remote code execution with SSH argument injection (RHEL-158310) - node: update lodash dependency (RHEL-164196) - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - Package manifests: Add `any` test - Bug fixes and translation updates - sosreport: Provide encryption pass via an env variable (RHEL-220573) - ws: Prevent remote code execution with SSH argument injection (RHEL-158310) - node: update lodash dependency (RHEL-164196) - systemd: Allow editing timers created by Cockpit - Convert license headers to SPDX format - ws: Remove obsolete pam_cockpit_cert module - shell: add StartTransientUnit as a sudo alternative - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert documentation to AsciiDoc - Work around Firefox 146/147 bug (rhbz#2422331) - Bug fixes - Release workflow fixes - Firewall ports can be deleted individually - networking: fix renaming of bridges and other groups (RHEL-117883) - bridge: fix OpenSSH_10.2p1 host key detection - fold: fix processing of malformed UTF-8 sequences (RHEL-136086) - fix sort fdlimit test failures on s390x with /dev/z90crypt (RHEL-60290) - fix affinity mask handling in nproc for large CPU counts (RHEL-54139) - fix extended upstream test suite failures (RHEL-60290) - fix fold exit code for non-existent files (RHEL-54568) - enable LTO on ppc64le - fix tail on kernels with 64k page sizes (RHEL-22866) - unexpand: fix CVE-2026-56392 and related crashes (RHEL-216788) - fix direct.sh and unexpand/mb.sh tests - fix heap overflow with large tab stops - fix heap overflow when a wide blank overshoots a tab stop - CVE-2025-5278 - Fix Heap Buffer Under-Read in sort via Key Specification (RHEL-180331) - fold: fix processing of malformed UTF-8 sequences (RHEL-136086) - fix sort fdlimit test failures on s390x with /dev/z90crypt (RHEL-60290) - fix affinity mask handling in nproc for large CPU counts (RHEL-54139) - fix extended upstream test suite failures (RHEL-60290) - fix fold exit code for non-existent files (RHEL-54568) - enable LTO on ppc64le - CVE-2025-5278 - Fix Heap Buffer Under-Read in sort via Key Specification (RHEL-180331) - fold: fix processing of malformed UTF-8 sequences (RHEL-136086) - fix sort fdlimit test failures on s390x with /dev/z90crypt (RHEL-60290) - fix affinity mask handling in nproc for large CPU counts (RHEL-54139) - fix extended upstream test suite failures (RHEL-60290) - fix fold exit code for non-existent files (RHEL-54568) - enable LTO on ppc64le - fold: fix processing of malformed UTF-8 sequences (RHEL-136086) - fix sort fdlimit test failures on s390x with /dev/z90crypt (RHEL-60290) - fix affinity mask handling in nproc for large CPU counts (RHEL-54139) - fix extended upstream test suite failures (RHEL-60290) - fix fold exit code for non-existent files (RHEL-54568) - enable LTO on ppc64le - fix tail on kernels with 64k page sizes (RHEL-22866) - unexpand: fix CVE-2026-56392 and related crashes (RHEL-216788) - fix direct.sh and unexpand/mb.sh tests - fix heap overflow with large tab stops - fix heap overflow when a wide blank overshoots a tab stop - CVE-2025-5278 - Fix Heap Buffer Under-Read in sort via Key Specification (RHEL-180331) - fold: fix processing of malformed UTF-8 sequences (RHEL-136086) - fix sort fdlimit test failures on s390x with /dev/z90crypt (RHEL-60290) - fix affinity mask handling in nproc for large CPU counts (RHEL-54139) - fix extended upstream test suite failures (RHEL-60290) - fix fold exit code for non-existent files (RHEL-54568) - enable LTO on ppc64le - CVE-2025-5278 - Fix Heap Buffer Under-Read in sort via Key Specification (RHEL-180331) - fold: fix processing of malformed UTF-8 sequences (RHEL-136086) - fix sort fdlimit test failures on s390x with /dev/z90crypt (RHEL-60290) - fix affinity mask handling in nproc for large CPU counts (RHEL-54139) - fix extended upstream test suite failures (RHEL-60290) - fix fold exit code for non-existent files (RHEL-54568) - enable LTO on ppc64le - fold: fix processing of malformed UTF-8 sequences (RHEL-136086) - fix sort fdlimit test failures on s390x with /dev/z90crypt (RHEL-60290) - fix affinity mask handling in nproc for large CPU counts (RHEL-54139) - fix extended upstream test suite failures (RHEL-60290) - fix fold exit code for non-existent files (RHEL-54568) - enable LTO on ppc64le - fix tail on kernels with 64k page sizes (RHEL-22866) - unexpand: fix CVE-2026-56392 and related crashes (RHEL-216788) - fix direct.sh and unexpand/mb.sh tests - fix heap overflow with large tab stops - fix heap overflow when a wide blank overshoots a tab stop - CVE-2025-5278 - Fix Heap Buffer Under-Read in sort via Key Specification (RHEL-180331) - fold: fix processing of malformed UTF-8 sequences (RHEL-136086) - fix sort fdlimit test failures on s390x with /dev/z90crypt (RHEL-60290) - fix affinity mask handling in nproc for large CPU counts (RHEL-54139) - fix extended upstream test suite failures (RHEL-60290) - fix fold exit code for non-existent files (RHEL-54568) - enable LTO on ppc64le - CVE-2025-5278 - Fix Heap Buffer Under-Read in sort via Key Specification (RHEL-180331) - fold: fix processing of malformed UTF-8 sequences (RHEL-136086) - fix sort fdlimit test failures on s390x with /dev/z90crypt (RHEL-60290) - fix affinity mask handling in nproc for large CPU counts (RHEL-54139) - fix extended upstream test suite failures (RHEL-60290) - fix fold exit code for non-existent files (RHEL-54568) - enable LTO on ppc64le - Fixed CVE-2021-38185 (#1992512) - Revert patch for CVE-2021-38185 (#1992512) - Minor fix for CVE-2021-38185 (#1992512) - Fixed CVE-2021-38185 (#1992512) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Properly drop priviledges for remote command - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - update URL (RHEL-5215) - update URL (RHEL-5215) - Forward XDG_SESSION_CLASS to PAM for session classification - Also use systemd_tmpfiles to create files in /var, to ensure Cronie - works properly in Image mode - Resolves: RHEL-131190, RHEL-136491, RHEL-136492 - Move parsing code before separator check - Related: RHEL-82795 - Rename variables in get_range() - Step size out fo bound handling - Fix range parsing - Resolves: RHEL-82795 - Create anacron timestamp files with correct permissions - Resolves: RHEL-5376 - Add `increase_max_crontabs.patch` - Resolves: RHEL-60279 - Forward XDG_SESSION_CLASS to PAM for session classification - Also use systemd_tmpfiles to create files in /var, to ensure Cronie - works properly in Image mode - Resolves: RHEL-131190, RHEL-136491, RHEL-136492 - Move parsing code before separator check - Related: RHEL-82795 - Rename variables in get_range() - Step size out fo bound handling - Fix range parsing - Resolves: RHEL-82795 - Create anacron timestamp files with correct permissions - Resolves: RHEL-5376 - Add `increase_max_crontabs.patch` - Resolves: RHEL-60279 - Forward XDG_SESSION_CLASS to PAM for session classification - Also use systemd_tmpfiles to create files in /var, to ensure Cronie - works properly in Image mode - Resolves: RHEL-131190, RHEL-136491, RHEL-136492 - Move parsing code before separator check - Related: RHEL-82795 - Rename variables in get_range() - Step size out fo bound handling - Fix range parsing - Resolves: RHEL-82795 - Create anacron timestamp files with correct permissions - Resolves: RHEL-5376 - Add `increase_max_crontabs.patch` - Resolves: RHEL-60279 - Replace Recommends: cronie with weaker Suggests: Resolves: rhbz#1947899 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - openssh: enable mlkem768x25519-sha256 - gnutls: enable ML-KEM and ML-DSA - sequoia: register "eddsa" as an alias to EDDSA-ED25519 - rpm-sequoia: enable MLDSA65-ED25519 and MLDSA87-ED448 in all policies - rpm-sequoia: enable SHA-1 in all policies - rpm-sequoia: force enable all PQ algorithms for now - nss: enable ML-KEM and ML-DSA - rpm-sequoia: add back-end - openssl: send one PQ and one classic key_share; prioritize PQ groups - policies: alias X25519-MLKEM768 to MLKEM768-X25519 - nss: enable ED25519 - openssl: fix mistakes in integrity-only cipher definitions - PQ: add a subpolicy with some post-quantum algorithms - openssl: stricter enabling of Ciphersuites - openssl: make use of -CBC and -AESGCM keywords - release bump - fips-mode-setup: small Argon2 detection fix - fips-mode-setup: block if LUKS devices using Argon2 are detected - openssh: enable mlkem768x25519-sha256 - gnutls: enable ML-KEM and ML-DSA - sequoia: register "eddsa" as an alias to EDDSA-ED25519 - rpm-sequoia: enable MLDSA65-ED25519 and MLDSA87-ED448 in all policies - rpm-sequoia: enable SHA-1 in all policies - rpm-sequoia: force enable all PQ algorithms for now - nss: enable ML-KEM and ML-DSA - rpm-sequoia: add back-end - openssl: send one PQ and one classic key_share; prioritize PQ groups - policies: alias X25519-MLKEM768 to MLKEM768-X25519 - nss: enable ED25519 - openssl: fix mistakes in integrity-only cipher definitions - PQ: add a subpolicy with some post-quantum algorithms - openssl: stricter enabling of Ciphersuites - openssl: make use of -CBC and -AESGCM keywords - release bump - fips-mode-setup: small Argon2 detection fix - fips-mode-setup: block if LUKS devices using Argon2 are detected - patch: Read integrity profile info from top level device. - patch: Fix possible use of uninitialized variable. - patch: Reinstate pbkdf serialization flag in device activation. - patch: Fix LUKS2 device status in inline HW mode and detached header. - patch: Set inline integrity flag if no underlying dm-integrity device. - patch: Fix wrong device size status reports in cryptsetup and integritysetup. - Resolves: RHEL-122297 RHEL-125152 RHEL-125167 RHEL-132585 RHEL-140106 - patch: Improve check for a function attribute support. - Resolves: 100089 - Update to cryptsetup 2.8.1. - Resolves: 100089 - patch: Ignore unknown VMK entry 24 in bitlk metadata. - Resolves: RHEL-94860 - Specbump for correct target release. - Resolves: RHEL-39003 RHEL-41238 - patch: Warn if Argon2 keyslot is unlocked in FIPS mode. - patch: Enable Argon2 in FIPS with openssl backend. - patch: Abort online reencryption for misconfigured devices. - patch: Harden online reencryption checks in initialization phase. - patch: Fix detection of direct-io with suspended devices. - patch: Return suspended status also for unknow target types. - patch: Do not handle device as suspended on error. - Resolves: RHEL-39003 RHEL-41238 - Update to cryptsetup 2.7.2 - Use OpenSLL Argon implementation instead of the built-in one - Resolves: RHEL-32377 - patch: Read integrity profile info from top level device. - patch: Fix possible use of uninitialized variable. - patch: Reinstate pbkdf serialization flag in device activation. - patch: Fix LUKS2 device status in inline HW mode and detached header. - patch: Set inline integrity flag if no underlying dm-integrity device. - patch: Fix wrong device size status reports in cryptsetup and integritysetup. - Resolves: RHEL-122297 RHEL-125152 RHEL-125167 RHEL-132585 RHEL-140106 - patch: Improve check for a function attribute support. - Resolves: 100089 - Update to cryptsetup 2.8.1. - Resolves: 100089 - patch: Ignore unknown VMK entry 24 in bitlk metadata. - Resolves: RHEL-94860 - Specbump for correct target release. - Resolves: RHEL-39003 RHEL-41238 - patch: Warn if Argon2 keyslot is unlocked in FIPS mode. - patch: Enable Argon2 in FIPS with openssl backend. - patch: Abort online reencryption for misconfigured devices. - patch: Harden online reencryption checks in initialization phase. - patch: Fix detection of direct-io with suspended devices. - patch: Return suspended status also for unknow target types. - patch: Do not handle device as suspended on error. - Resolves: RHEL-39003 RHEL-41238 - Update to cryptsetup 2.7.2 - Use OpenSLL Argon implementation instead of the built-in one - Resolves: RHEL-32377 - RHEL-147214 - endless poll loop in http_write when POLLHUP is returned - RHEL-129747 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack - RHEL-129740 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues - RHEL-122629 [image-mode] Missing /var/log/cups - RHEL-102665 The KONICA MINOLTA C352 is not distributed using cups-browsed and the included ppd file - RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling - RHEL-113078 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS - Add NoSystem SSLOptions value - RHEL-68414 Inability to disable weak ciphers in CUPS configuration - RHEL-60343 CVE-2024-47175 cups: remote command injection via attacker controlled data in PPD file - RHEL-6526 cups source rpm doesn't actually build lspp support - fix memory leaks from LSPP - Revert the cups-libs license identifier to the "legacy" format - RHEL-177957 CVE-2026-34980 cups: control character injection in option values - RHEL-147214 - endless poll loop in http_write when POLLHUP is returned - RHEL-129747 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack - RHEL-129740 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues - RHEL-122629 [image-mode] Missing /var/log/cups - RHEL-102665 The KONICA MINOLTA C352 is not distributed using cups-browsed and the included ppd file - RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling - RHEL-113078 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS - Add NoSystem SSLOptions value - RHEL-68414 Inability to disable weak ciphers in CUPS configuration - RHEL-60343 CVE-2024-47175 cups: remote command injection via attacker controlled data in PPD file - RHEL-6526 cups source rpm doesn't actually build lspp support - fix memory leaks from LSPP - openssl: fix libssh compatibility by preserving original SSL_CTX behavior (RHEL-134721) - openssl: fix libssh compatibility in crypto-policy patch (RHEL-134721) - http: fix crash in rate-limited upload (RHEL-131696) - openssl: respect system crypto policy for TLS max version (RHEL-128914) - rebuild for c9s (RHEL-125838) - cookie: don't treat the leading slash as trailing (CVE-2025-9086) Resolves: RHEL-121659 - revert several disabled tests related to openssl/valgrind (RHEL-99465) - noproxy: support proxies specified using cidr notation (RHEL-81412) - make up incomplete patch for host name wildcard checking (RHEL-5675) - eliminate use of obsolete patch syntax (RHEL-65791) - http2: make sure pause is done on HTTP (RHEL-85847) - provide common cleanup method for push headers (CVE-2024-2398) - fix missing %patch macros for Patch46 and Patch47 - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind) - tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race) - fix SSH host key mismatch on type difference (CVE-2026-9547) - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286) - openssl: fix libssh compatibility by preserving original SSL_CTX behavior (RHEL-134721) - openssl: fix libssh compatibility in crypto-policy patch (RHEL-134721) - http: fix crash in rate-limited upload (RHEL-131696) - openssl: respect system crypto policy for TLS max version (RHEL-128914) - rebuild for c9s (RHEL-125838) - cookie: don't treat the leading slash as trailing (CVE-2025-9086) Resolves: RHEL-121659 - add sasl service name to connection reuse checks (CVE-2026-8458) - detect proxy changes read from environment (CVE-2026-8927) - fix missing %patch macros for Patch46 and Patch47 - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind) - tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race) - fix SSH host key mismatch on type difference (CVE-2026-9547) - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286) - openssl: fix libssh compatibility by preserving original SSL_CTX behavior (RHEL-134721) - openssl: fix libssh compatibility in crypto-policy patch (RHEL-134721) - http: fix crash in rate-limited upload (RHEL-131696) - openssl: respect system crypto policy for TLS max version (RHEL-128914) - fix cookie injection via trailing dot super cookies (CVE-2026-8924) - fix digest auth state leak on origin or credential change (CVE-2026-11856) - add sasl service name to connection reuse checks (CVE-2026-8458) - detect proxy changes read from environment (CVE-2026-8927) - fix missing %patch macros for Patch46 and Patch47 - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind) - tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race) - fix SSH host key mismatch on type difference (CVE-2026-9547) - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286) - openssl: fix libssh compatibility by preserving original SSL_CTX behavior (RHEL-134721) - openssl: fix libssh compatibility in crypto-policy patch (RHEL-134721) - http: fix crash in rate-limited upload (RHEL-131696) - openssl: fix libssh compatibility by preserving original SSL_CTX behavior (RHEL-134721) - openssl: fix libssh compatibility in crypto-policy patch (RHEL-134721) - http: fix crash in rate-limited upload (RHEL-131696) - openssl: respect system crypto policy for TLS max version (RHEL-128914) - rebuild for c9s (RHEL-125838) - cookie: don't treat the leading slash as trailing (CVE-2025-9086) Resolves: RHEL-121659 - revert several disabled tests related to openssl/valgrind (RHEL-99465) - noproxy: support proxies specified using cidr notation (RHEL-81412) - make up incomplete patch for host name wildcard checking (RHEL-5675) - eliminate use of obsolete patch syntax (RHEL-65791) - http2: make sure pause is done on HTTP (RHEL-85847) - provide common cleanup method for push headers (CVE-2024-2398) - fix missing %patch macros for Patch46 and Patch47 - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind) - tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race) - fix SSH host key mismatch on type difference (CVE-2026-9547) - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286) - openssl: fix libssh compatibility by preserving original SSL_CTX behavior (RHEL-134721) - openssl: fix libssh compatibility in crypto-policy patch (RHEL-134721) - http: fix crash in rate-limited upload (RHEL-131696) - openssl: respect system crypto policy for TLS max version (RHEL-128914) - rebuild for c9s (RHEL-125838) - cookie: don't treat the leading slash as trailing (CVE-2025-9086) Resolves: RHEL-121659 - add sasl service name to connection reuse checks (CVE-2026-8458) - detect proxy changes read from environment (CVE-2026-8927) - fix missing %patch macros for Patch46 and Patch47 - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind) - tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race) - fix SSH host key mismatch on type difference (CVE-2026-9547) - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286) - openssl: fix libssh compatibility by preserving original SSL_CTX behavior (RHEL-134721) - openssl: fix libssh compatibility in crypto-policy patch (RHEL-134721) - http: fix crash in rate-limited upload (RHEL-131696) - openssl: respect system crypto policy for TLS max version (RHEL-128914) - fix cookie injection via trailing dot super cookies (CVE-2026-8924) - fix digest auth state leak on origin or credential change (CVE-2026-11856) - add sasl service name to connection reuse checks (CVE-2026-8458) - detect proxy changes read from environment (CVE-2026-8927) - fix missing %patch macros for Patch46 and Patch47 - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind) - tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race) - fix SSH host key mismatch on type difference (CVE-2026-9547) - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286) - openssl: fix libssh compatibility by preserving original SSL_CTX behavior (RHEL-134721) - openssl: fix libssh compatibility in crypto-policy patch (RHEL-134721) - http: fix crash in rate-limited upload (RHEL-131696) - Rebase to v82 - Resolve: RHEL-97669 - Add explicit package version requirements. (Jeff Moyer) - Related: RHEL-29151 - Rebase to v78 - Add support for legacy monitor.conf file location - Fix a test failure. - Resolves: RHEL-10382 - Resolves: RHEL-8204 - Resolves: RHEL-29151 - Remove debug log spam in digestmd5 plugin (RHEL-82172) - Remove debug log spam in digestmd5 plugin (RHEL-82172) - Remove debug log spam in digestmd5 plugin (RHEL-82172) - Remove debug log spam in digestmd5 plugin (RHEL-82172) - Remove debug log spam in digestmd5 plugin (RHEL-82172) - Rebase to v82 - Resolve: RHEL-97669 - Add explicit package version requirements. (Jeff Moyer) - Related: RHEL-29151 - Rebase to v78 - Add support for legacy monitor.conf file location - Fix a test failure. - Resolves: RHEL-10382 - Resolves: RHEL-8204 - Resolves: RHEL-29151 - Fix CVE-2023-34969 (#2213402) - Fix CVE-2022-42010 (#2133647) - Fix CVE-2022-42011 (#2133641) - Fix CVE-2022-42012 (#2133635) - Override upstream sysusers.d confguration (#2118226) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add coverage for CVE-2022-31213 and other config-file-related issues Related: CVE-2022-31213 - Fix a stack buffer over-read in the c-shquote library - Fix null pointer reference when supplying a malformed XML config file Resolves: CVE-2022-31212 Resolves: CVE-2022-31213 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Apply another fix for incorrect at_console range assertion. - Apply fix for incorrect at_console range assertion. - Update to upstream v28. - Drop unused c-util based bundling annotations. - Apply activation-tracking bugfixes from upstream. - Update to upstream v27. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Fix session bus denial of service via EMFILE during peer setup. Resolves: RHEL-233014 - Switch from useradd to systemd sysusers Resolves: RHEL-109036 - Fix CVE-2023-34969 (#2213402) - Fix CVE-2022-42010 (#2133647) - Fix CVE-2022-42011 (#2133641) - Fix CVE-2022-42012 (#2133635) - Override upstream sysusers.d confguration (#2118226) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fix CVE-2023-34969 (#2213402) - Fix CVE-2022-42010 (#2133647) - Fix CVE-2022-42011 (#2133641) - Fix CVE-2022-42012 (#2133635) - Override upstream sysusers.d confguration (#2118226) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fix CVE-2023-34969 (#2213402) - Fix CVE-2022-42010 (#2133647) - Fix CVE-2022-42011 (#2133641) - Fix CVE-2022-42012 (#2133635) - Override upstream sysusers.d confguration (#2118226) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 2.37-15 - Fix this spec file to build for F33+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - 2.37-13 🐞 Workaround Fedora problems created by rpm commit 93604e2 - 2.37-12 👻 Rebuild with fonts-rpm-macros 2.0.4 to make sure fontconfig files are valid - 2.37-7 ✅ Remove F32 compatibility packages - 2.37-6 ✅ Lint, lint, lint and lint again - 2.37-5 ✅ Rebuild with fonts-rpm-macros 2.0.2 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 2.37-15 - Fix this spec file to build for F33+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - 2.37-13 🐞 Workaround Fedora problems created by rpm commit 93604e2 - 2.37-12 👻 Rebuild with fonts-rpm-macros 2.0.4 to make sure fontconfig files are valid - 2.37-7 ✅ Remove F32 compatibility packages - 2.37-6 ✅ Lint, lint, lint and lint again - 2.37-5 ✅ Rebuild with fonts-rpm-macros 2.0.2 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 2.37-15 - Fix this spec file to build for F33+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - 2.37-13 🐞 Workaround Fedora problems created by rpm commit 93604e2 - 2.37-12 👻 Rebuild with fonts-rpm-macros 2.0.4 to make sure fontconfig files are valid - 2.37-7 ✅ Remove F32 compatibility packages - 2.37-6 ✅ Lint, lint, lint and lint again - 2.37-5 ✅ Rebuild with fonts-rpm-macros 2.0.2 - Handle wrong XFS reported size when shrinking LV immediately after growing. - Allow integrity to use multiple segments for metadata. - Add message when activating RAID volumes with snapshots. - Update to upstream version 2.03.33. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix vgremove hanging immediately after lockstart. - Add repair option for RAID volumes with too many transiently failed devices. - Update to upstream version 2.03.32. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix race causing lvm2 not recognizing active devices. - Fix temporary LVs not cleaned when converting in use LV to a thin pool. - Check FS resize is supported before extending LV. - Fix issue affecting memory locking before suspend (2.03.27). - Workaround for NVMe WWID changing after kernel update. - Fix duplicate LV names when converting pools to RAID1 with more than 2 legs. - Fix false positive warnings about stray FDs on s390x. - Handle wrong XFS reported size when shrinking LV immediately after growing. - Allow integrity to use multiple segments for metadata. - Add message when activating RAID volumes with snapshots. - Update to upstream version 2.03.33. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix vgremove hanging immediately after lockstart. - Add repair option for RAID volumes with too many transiently failed devices. - Update to upstream version 2.03.32. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix race causing lvm2 not recognizing active devices. - Fix temporary LVs not cleaned when converting in use LV to a thin pool. - Check FS resize is supported before extending LV. - Fix issue affecting memory locking before suspend (2.03.27). - Workaround for NVMe WWID changing after kernel update. - Handle wrong XFS reported size when shrinking LV immediately after growing. - Allow integrity to use multiple segments for metadata. - Add message when activating RAID volumes with snapshots. - Update to upstream version 2.03.33. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix vgremove hanging immediately after lockstart. - Add repair option for RAID volumes with too many transiently failed devices. - Update to upstream version 2.03.32. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix race causing lvm2 not recognizing active devices. - Fix temporary LVs not cleaned when converting in use LV to a thin pool. - Check FS resize is supported before extending LV. - Fix issue affecting memory locking before suspend (2.03.27). - Workaround for NVMe WWID changing after kernel update. - Fix duplicate LV names when converting pools to RAID1 with more than 2 legs. - Fix false positive warnings about stray FDs on s390x. - Handle wrong XFS reported size when shrinking LV immediately after growing. - Allow integrity to use multiple segments for metadata. - Add message when activating RAID volumes with snapshots. - Update to upstream version 2.03.33. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix vgremove hanging immediately after lockstart. - Add repair option for RAID volumes with too many transiently failed devices. - Update to upstream version 2.03.32. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix race causing lvm2 not recognizing active devices. - Fix temporary LVs not cleaned when converting in use LV to a thin pool. - Check FS resize is supported before extending LV. - Fix issue affecting memory locking before suspend (2.03.27). - Workaround for NVMe WWID changing after kernel update. - Handle wrong XFS reported size when shrinking LV immediately after growing. - Allow integrity to use multiple segments for metadata. - Add message when activating RAID volumes with snapshots. - Update to upstream version 2.03.33. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix vgremove hanging immediately after lockstart. - Add repair option for RAID volumes with too many transiently failed devices. - Update to upstream version 2.03.32. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix race causing lvm2 not recognizing active devices. - Fix temporary LVs not cleaned when converting in use LV to a thin pool. - Check FS resize is supported before extending LV. - Fix issue affecting memory locking before suspend (2.03.27). - Workaround for NVMe WWID changing after kernel update. - Fix duplicate LV names when converting pools to RAID1 with more than 2 legs. - Fix false positive warnings about stray FDs on s390x. - Handle wrong XFS reported size when shrinking LV immediately after growing. - Allow integrity to use multiple segments for metadata. - Add message when activating RAID volumes with snapshots. - Update to upstream version 2.03.33. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix vgremove hanging immediately after lockstart. - Add repair option for RAID volumes with too many transiently failed devices. - Update to upstream version 2.03.32. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix race causing lvm2 not recognizing active devices. - Fix temporary LVs not cleaned when converting in use LV to a thin pool. - Check FS resize is supported before extending LV. - Fix issue affecting memory locking before suspend (2.03.27). - Workaround for NVMe WWID changing after kernel update. - Handle wrong XFS reported size when shrinking LV immediately after growing. - Allow integrity to use multiple segments for metadata. - Add message when activating RAID volumes with snapshots. - Update to upstream version 2.03.33. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix vgremove hanging immediately after lockstart. - Add repair option for RAID volumes with too many transiently failed devices. - Update to upstream version 2.03.32. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix race causing lvm2 not recognizing active devices. - Fix temporary LVs not cleaned when converting in use LV to a thin pool. - Check FS resize is supported before extending LV. - Fix issue affecting memory locking before suspend (2.03.27). - Workaround for NVMe WWID changing after kernel update. - Fix duplicate LV names when converting pools to RAID1 with more than 2 legs. - Fix false positive warnings about stray FDs on s390x. - Handle wrong XFS reported size when shrinking LV immediately after growing. - Allow integrity to use multiple segments for metadata. - Add message when activating RAID volumes with snapshots. - Update to upstream version 2.03.33. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix vgremove hanging immediately after lockstart. - Add repair option for RAID volumes with too many transiently failed devices. - Update to upstream version 2.03.32. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix race causing lvm2 not recognizing active devices. - Fix temporary LVs not cleaned when converting in use LV to a thin pool. - Check FS resize is supported before extending LV. - Fix issue affecting memory locking before suspend (2.03.27). - Workaround for NVMe WWID changing after kernel update. - Add 0208-libmpathpersist-fix-register-retry-status-checking.patch - Add 0209-multipathd-remember-number-of-registered-keys-when-i.patch - Add 0210-libmpathpersist-fix-code-for-skipping-multipathd-pat.patch * Fixes RHEL-148462 ("Improve multipathd's handling of updating persistent reservations on restored paths. [rhel-9]") - Resolves: RHEL-148462 - Add 0206-libmultipath-add-purge_disconnected-configuration-op.patch - Add 0207-multipathd-implement-purge-functionality-for-disconn.patch * Fixes RHEL-141291 ("Add purge_disconnected support to multipathd [rhel-9]") - Resolves: RHEL-141291 - Add 0198-multipathd-print-path-offline-message-even-without-a.patch * Fixes RHEL-133814 ("log_checker_err is not printing messages repeatedly for failed path [rhel-9]") - Add 0199-libmultipath-improve-cleanup-of-uevent-queues-on-exi.patch - Add 0200-uevent_dispatch-use-while-in-wait-loop.patch - Add 0201-libmultipath-uevent_dispatch-process-uevents-one-by-.patch - Add 0202-libmultipath-uevent_listen-don-t-delay-uevents.patch - Add 0203-libmultipath-uevent-use-struct-to-pass-parameters-ar.patch - Add 0204-libmultipath-is_uevent_busy-check-servicing_uev-unde.patch - Add 0205-multipathd-make-multipathd-show-status-busy-checker-.patch * Fixes RHEL-135904 (VM reboot in RHOSP environment fails with error "Could not open '/dev/dm-95': No such file or directory") - Resolves: RHEL-133814 - Resolves: RHEL-135904 - Add 0197-multipath-tools-update-NFINIDAT-InfiniBox-config-in-.patch * Fixes RHEL-128396 ("Update the multipath.conf stanza for Infinidat storage [rhel-9]") - Resolves: RHEL-128396 - Add 0195-multipathd-Fix-race-while-registering-PR-key.patch - Add 0196-mpathpersist-Fix-REPORT-CAPABILITIES-output.patch * Fixes RHEL-118515 ("There are many bugs in multipath's persistent reservation handling") - Resolves: RHEL-118515 - Add 0150-libmpathpersist-retry-commands-on-other-paths-in-mpa.patch - Add 0151-libmpathpersist-check-released-key-against-the-reser.patch - Add 0152-multipathd-remove-thread-from-mpath_pr_event_handle.patch - Add 0153-libmpathpersist-remove-uneeded-wrapper-function.patch - Add 0154-libmpathpersist-reduce-log-level-for-persistent-rese.patch - Add 0155-libmpathpersist-remove-pointless-update_map_pr-ret-v.patch - Add 0156-multipathd-use-update_map_pr-in-mpath_pr_event_handl.patch - Add 0157-libmpathpersist-limit-changing-prflag-in-update_map_.patch - Add 0158-multipathd-Don-t-call-update_map_pr-unnecessarily.patch - Add 0159-libmpathpersist-remove-useless-function-send_prout_a.patch - Add 0160-libmpathpersist-fix-memory-leak-in-mpath_prout_rel.patch - Add 0161-limpathpersist-redesign-failed-release-workaround.patch - Add 0162-libmpathpersist-fail-the-release-if-all-threads-fail.patch - Add 0163-limpathpersist-Handle-changing-key-corner-case.patch - Add 0164-libmpathpersist-fix-command-keyword-ordering.patch - Add 0165-libmpathpersist-use-conf-timeout-for-updating-persis.patch - Add 0166-libmapthpersist-Handle-REGISTER-AND-IGNORE-changing-.patch - Add 0167-libmultipath-rename-prflag_value-enums.patch - Add 0168-libmpathpersist-use-a-switch-statement-for-prout-com.patch - Add 0169-libmpathpersist-Add-safety-check-for-preempting-on-k.patch - Add 0170-limpathpersist-remove-update_map_pr-code-for-NULL-pp.patch - Add 0171-libmpathpersist-move-update_map_pr-to-multipathd.patch - Add 0172-multipathd-clean-up-update_map_pr-and-mpath_pr_event.patch - Add 0173-libmpathpersist-clean-up-duplicate-function-declarat.patch - Add 0174-multipathd-wrap-setting-and-unsetting-prflag.patch - Add 0175-multipathd-unregister-PR-key-when-path-is-restored-i.patch - Add 0176-libmpathpersist-Fix-up-reservation_key-checking.patch - Add 0177-libmpathpersist-change-how-reservation-conflicts-are.patch - Add 0178-libmpathpersist-Clear-prkey-in-multipathd-before-unr.patch - Add 0179-libmpathpersist-only-clear-the-key-if-we-are-using-t.patch - Add 0180-libmpathpersist-Restore-old-reservation-key-on-failu.patch - Add 0181-libmpatpersist-update-reservation-key-before-checkin.patch - Add 0182-libmpathpersist-retry-on-conflicts-in-mpath_prout_co.patch - Add 0183-libmpathpersist-Don-t-always-fail-registrations-for-.patch - Add 0184-libmpathpersist-Don-t-try-release-workaround-for-inv.patch - Add 0185-libmpathpersist-Don-t-fail-RESERVE-commands-unnecess.patch - Add 0186-libmpathpersist-reregister-keys-when-self-preempting.patch - Add 0187-libmpathpersist-handle-updating-key-race-condition.patch - Add 0188-libmpathpersist-handle-preempting-all-registrants-re.patch - Add 0189-libmpathpersist-Fix-REGISTER-AND-IGNORE-while-holdin.patch - Add 0190-libmpathpersist-Handle-RESERVE-with-reservation-held.patch - Add 0191-libmpathpersist-use-check_holding_reservation-in-mpa.patch - Add 0192-libmpathpersist-Fix-unregistering-while-holding-the-.patch - Add 0193-libmpathpersist-Fix-race-between-restoring-a-path-an.patch - Add 0194-multipathd-Fix-tracking-of-old-PR-key.patch * Fixes RHEL-118515 ("There are many bugs in multipath's persistent reservation handling") - Resolves: RHEL-118515 - Add 0145-multipath-tools-add-DellEMC-ME4-PowerVault-ME4-to-ha.patch - Add 0146-multipath-tools-add-HPE-as-vendor-for-OPEN-XP8-array.patch - Add 0147-multipath-tools-add-HP-HSVX740-to-hwtable.patch - Add 0148-multipath-tools-add-DellEMC-ME5-PowerVault-ME5-to-ha.patch - Add 0149-multipath-tools-add-HPE-MSA-Gen7-2070-2072-to-hwtabl.patch * Fixes RHEL-103109 ("Update multipath builtin config to add new device defaults") - Resolves: RHEL-103109 - Add 0142-multipathd-monitor-new-multipath-dev-even-if-we-can-.patch - Add 0143-libmultipath-add-helper-function-check_path_wwid_cha.patch - Add 0144-multipathd-re-add-paths-skipped-because-they-were-of.patch * Fixes RHEL-82534 ("multipathd does not monitor multipath devices created externally while there are offline paths.") - Resolves: RHEL-82534 - Add 0140-multipath-clean-up-find_multipaths-value-names.patch - Add 0141-multipathd-Add-multipathd-man-page-section-about-soc.patch * Fixes RHEL-82307 ("There is no man page for RFE: Enable multipathd to communicate with a process in another network namespace") - Fix multipath_conf_syntax OSCI test. - Resolves: RHEL-82307 - Add 0128-multipath-tools-move-DEFAULT_SOCKET-definition-into-.patch - Add 0129-multipath-tools-add-helper-mpath_fill_sockaddr__.patch - Add 0130-libmpathutil-add-support-for-Unix-pathname-sockets.patch - Add 0131-libmpathutil-move-systemd_listen_fds-support-into-mu.patch - Add 0132-multipathd-move-uxsock_trigger-to-uxlsnr.c.patch - Add 0133-multipathd-uxlsnr-use-symbolic-values-for-pollfd-ind.patch - Add 0134-multipathd-make-uxsock_listen-take-a-pointer-to-fd.patch - Add 0135-multipathd-allow-receiving-two-socket-fds-from-syste.patch - Add 0136-multipathd-listen-on-pathname-and-abstract-socket-by.patch - Add 0137-libmpathcmd-try-both-abstract-and-pathname-sockets.patch - Add 0138-libmpathcmd-honor-MULTIPATH_SOCKET_NAME-environment-.patch - Add 0139-multipathd-honor-MULTIPATH_SOCKET_NAME-environment-v.patch * Fixes RHEL-78758 ("RFE: Enable multipathd to communicate with a process in another network namespace") - Resolves: RHEL-78758 - Add 0208-libmpathpersist-fix-register-retry-status-checking.patch - Add 0209-multipathd-remember-number-of-registered-keys-when-i.patch - Add 0210-libmpathpersist-fix-code-for-skipping-multipathd-pat.patch * Fixes RHEL-148462 ("Improve multipathd's handling of updating persistent reservations on restored paths. [rhel-9]") - Resolves: RHEL-148462 - Add 0206-libmultipath-add-purge_disconnected-configuration-op.patch - Add 0207-multipathd-implement-purge-functionality-for-disconn.patch * Fixes RHEL-141291 ("Add purge_disconnected support to multipathd [rhel-9]") - Resolves: RHEL-141291 - Add 0198-multipathd-print-path-offline-message-even-without-a.patch * Fixes RHEL-133814 ("log_checker_err is not printing messages repeatedly for failed path [rhel-9]") - Add 0199-libmultipath-improve-cleanup-of-uevent-queues-on-exi.patch - Add 0200-uevent_dispatch-use-while-in-wait-loop.patch - Add 0201-libmultipath-uevent_dispatch-process-uevents-one-by-.patch - Add 0202-libmultipath-uevent_listen-don-t-delay-uevents.patch - Add 0203-libmultipath-uevent-use-struct-to-pass-parameters-ar.patch - Add 0204-libmultipath-is_uevent_busy-check-servicing_uev-unde.patch - Add 0205-multipathd-make-multipathd-show-status-busy-checker-.patch * Fixes RHEL-135904 (VM reboot in RHOSP environment fails with error "Could not open '/dev/dm-95': No such file or directory") - Resolves: RHEL-133814 - Resolves: RHEL-135904 - Add 0197-multipath-tools-update-NFINIDAT-InfiniBox-config-in-.patch * Fixes RHEL-128396 ("Update the multipath.conf stanza for Infinidat storage [rhel-9]") - Resolves: RHEL-128396 - Add 0195-multipathd-Fix-race-while-registering-PR-key.patch - Add 0196-mpathpersist-Fix-REPORT-CAPABILITIES-output.patch * Fixes RHEL-118515 ("There are many bugs in multipath's persistent reservation handling") - Resolves: RHEL-118515 - Add 0150-libmpathpersist-retry-commands-on-other-paths-in-mpa.patch - Add 0151-libmpathpersist-check-released-key-against-the-reser.patch - Add 0152-multipathd-remove-thread-from-mpath_pr_event_handle.patch - Add 0153-libmpathpersist-remove-uneeded-wrapper-function.patch - Add 0154-libmpathpersist-reduce-log-level-for-persistent-rese.patch - Add 0155-libmpathpersist-remove-pointless-update_map_pr-ret-v.patch - Add 0156-multipathd-use-update_map_pr-in-mpath_pr_event_handl.patch - Add 0157-libmpathpersist-limit-changing-prflag-in-update_map_.patch - Add 0158-multipathd-Don-t-call-update_map_pr-unnecessarily.patch - Add 0159-libmpathpersist-remove-useless-function-send_prout_a.patch - Add 0160-libmpathpersist-fix-memory-leak-in-mpath_prout_rel.patch - Add 0161-limpathpersist-redesign-failed-release-workaround.patch - Add 0162-libmpathpersist-fail-the-release-if-all-threads-fail.patch - Add 0163-limpathpersist-Handle-changing-key-corner-case.patch - Add 0164-libmpathpersist-fix-command-keyword-ordering.patch - Add 0165-libmpathpersist-use-conf-timeout-for-updating-persis.patch - Add 0166-libmapthpersist-Handle-REGISTER-AND-IGNORE-changing-.patch - Add 0167-libmultipath-rename-prflag_value-enums.patch - Add 0168-libmpathpersist-use-a-switch-statement-for-prout-com.patch - Add 0169-libmpathpersist-Add-safety-check-for-preempting-on-k.patch - Add 0170-limpathpersist-remove-update_map_pr-code-for-NULL-pp.patch - Add 0171-libmpathpersist-move-update_map_pr-to-multipathd.patch - Add 0172-multipathd-clean-up-update_map_pr-and-mpath_pr_event.patch - Add 0173-libmpathpersist-clean-up-duplicate-function-declarat.patch - Add 0174-multipathd-wrap-setting-and-unsetting-prflag.patch - Add 0175-multipathd-unregister-PR-key-when-path-is-restored-i.patch - Add 0176-libmpathpersist-Fix-up-reservation_key-checking.patch - Add 0177-libmpathpersist-change-how-reservation-conflicts-are.patch - Add 0178-libmpathpersist-Clear-prkey-in-multipathd-before-unr.patch - Add 0179-libmpathpersist-only-clear-the-key-if-we-are-using-t.patch - Add 0180-libmpathpersist-Restore-old-reservation-key-on-failu.patch - Add 0181-libmpatpersist-update-reservation-key-before-checkin.patch - Add 0182-libmpathpersist-retry-on-conflicts-in-mpath_prout_co.patch - Add 0183-libmpathpersist-Don-t-always-fail-registrations-for-.patch - Add 0184-libmpathpersist-Don-t-try-release-workaround-for-inv.patch - Add 0185-libmpathpersist-Don-t-fail-RESERVE-commands-unnecess.patch - Add 0186-libmpathpersist-reregister-keys-when-self-preempting.patch - Add 0187-libmpathpersist-handle-updating-key-race-condition.patch - Add 0188-libmpathpersist-handle-preempting-all-registrants-re.patch - Add 0189-libmpathpersist-Fix-REGISTER-AND-IGNORE-while-holdin.patch - Add 0190-libmpathpersist-Handle-RESERVE-with-reservation-held.patch - Add 0191-libmpathpersist-use-check_holding_reservation-in-mpa.patch - Add 0192-libmpathpersist-Fix-unregistering-while-holding-the-.patch - Add 0193-libmpathpersist-Fix-race-between-restoring-a-path-an.patch - Add 0194-multipathd-Fix-tracking-of-old-PR-key.patch * Fixes RHEL-118515 ("There are many bugs in multipath's persistent reservation handling") - Resolves: RHEL-118515 - Add 0145-multipath-tools-add-DellEMC-ME4-PowerVault-ME4-to-ha.patch - Add 0146-multipath-tools-add-HPE-as-vendor-for-OPEN-XP8-array.patch - Add 0147-multipath-tools-add-HP-HSVX740-to-hwtable.patch - Add 0148-multipath-tools-add-DellEMC-ME5-PowerVault-ME5-to-ha.patch - Add 0149-multipath-tools-add-HPE-MSA-Gen7-2070-2072-to-hwtabl.patch * Fixes RHEL-103109 ("Update multipath builtin config to add new device defaults") - Resolves: RHEL-103109 - Add 0142-multipathd-monitor-new-multipath-dev-even-if-we-can-.patch - Add 0143-libmultipath-add-helper-function-check_path_wwid_cha.patch - Add 0144-multipathd-re-add-paths-skipped-because-they-were-of.patch * Fixes RHEL-82534 ("multipathd does not monitor multipath devices created externally while there are offline paths.") - Resolves: RHEL-82534 - Add 0140-multipath-clean-up-find_multipaths-value-names.patch - Add 0141-multipathd-Add-multipathd-man-page-section-about-soc.patch * Fixes RHEL-82307 ("There is no man page for RFE: Enable multipathd to communicate with a process in another network namespace") - Fix multipath_conf_syntax OSCI test. - Resolves: RHEL-82307 - Add 0128-multipath-tools-move-DEFAULT_SOCKET-definition-into-.patch - Add 0129-multipath-tools-add-helper-mpath_fill_sockaddr__.patch - Add 0130-libmpathutil-add-support-for-Unix-pathname-sockets.patch - Add 0131-libmpathutil-move-systemd_listen_fds-support-into-mu.patch - Add 0132-multipathd-move-uxsock_trigger-to-uxlsnr.c.patch - Add 0133-multipathd-uxlsnr-use-symbolic-values-for-pollfd-ind.patch - Add 0134-multipathd-make-uxsock_listen-take-a-pointer-to-fd.patch - Add 0135-multipathd-allow-receiving-two-socket-fds-from-syste.patch - Add 0136-multipathd-listen-on-pathname-and-abstract-socket-by.patch - Add 0137-libmpathcmd-try-both-abstract-and-pathname-sockets.patch - Add 0138-libmpathcmd-honor-MULTIPATH_SOCKET_NAME-environment-.patch - Add 0139-multipathd-honor-MULTIPATH_SOCKET_NAME-environment-v.patch * Fixes RHEL-78758 ("RFE: Enable multipathd to communicate with a process in another network namespace") - Resolves: RHEL-78758 - Update to latest upstream release 1.1.0. - Support listing the highest mapped block in thin_ls. - Introduce thin_migrate for volume migration. - See CHANGES. - Fix --version string compatibility with LVM tools. - Fix confusing Broken pipe warning when used in lvconvert --repair. - Allow non-zero values in unused index block entries. - Fix boundary check on the bitset for cached blocks. - Fix incorrect index_entry.nr_free on expansion affecting free space estimate. - Fix thin_repair checking keys on a node with a zero key. - Enhance error message in cache_check suggesting fix when applicable. - Update to latest upstream release 1.0.9. - Update to latest upstream release 1.0.6. - Update to latest upstream release 1.0.5. - Update to latest upstream release 1.0.4. - Create /var/lib/dhcpd through systemd-tmpfiles Resolves: RHEL-134207 - Create /var/lib/dhcpd through systemd-tmpfiles Resolves: RHEL-134207 - Create /var/lib/dhcpd through systemd-tmpfiles Resolves: RHEL-134207 - Create /var/lib/dhcpd through systemd-tmpfiles Resolves: RHEL-134207 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: #1975121, Handle SIGSTKSZ no longer being a constant. - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Fix coverity issues - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Fix from gnulib upstream, commit 175e0bc (bug #1863423). - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - update to upstream fa268715 Resolves: RHEL-97702 - updated to upstream v3.6 - Expanding the list of CPU sockets to match the list specified in SMBIOS 3.7.0 - Add processor support from SMBIOS-3.6.0 - Consistently use read_file when reading from a dump file - Added patch for almalinux bugtracker - bootc: unlock only if /usr is read-only (RHEL-138512) - autoremove: when a dangling protected dependency is found produce a wanrning and skip it (RHEL-76112) - automatic: Expand email_to in command_email emitter to individual arguments (RHEL-94321) - Introduce $releasever_major, $releasever_minor variables, shell-style variable substitution (RHEL-65817) - Mark transient transactions in DNF history (RHEL-84512) - Warn/disallow changes outside /usr, /etc with --transient (RHEL-84499) - man page: don't mark mandatory option parameters as optional (RHEL-63958) - Add dnf4 provides and symlink /usr/bin/dnf4 -> /usr/bin/dnf-3 (RHEL-82310) - usage help: don't mark mandatory option parameters as optional (RHEL-63958) - package: remote_location() takes basedir into account (RHEL-71125) - Added patch for almalinux bugtracker - bootc: unlock only if /usr is read-only (RHEL-138512) - autoremove: when a dangling protected dependency is found produce a wanrning and skip it (RHEL-76112) - automatic: Expand email_to in command_email emitter to individual arguments (RHEL-94321) - Introduce $releasever_major, $releasever_minor variables, shell-style variable substitution (RHEL-65817) - Mark transient transactions in DNF history (RHEL-84512) - Warn/disallow changes outside /usr, /etc with --transient (RHEL-84499) - man page: don't mark mandatory option parameters as optional (RHEL-63958) - Add dnf4 provides and symlink /usr/bin/dnf4 -> /usr/bin/dnf-3 (RHEL-82310) - usage help: don't mark mandatory option parameters as optional (RHEL-63958) - package: remote_location() takes basedir into account (RHEL-71125) - Added patch for almalinux bugtracker - bootc: unlock only if /usr is read-only (RHEL-138512) - autoremove: when a dangling protected dependency is found produce a wanrning and skip it (RHEL-76112) - automatic: Expand email_to in command_email emitter to individual arguments (RHEL-94321) - Introduce $releasever_major, $releasever_minor variables, shell-style variable substitution (RHEL-65817) - Mark transient transactions in DNF history (RHEL-84512) - Warn/disallow changes outside /usr, /etc with --transient (RHEL-84499) - man page: don't mark mandatory option parameters as optional (RHEL-63958) - Add dnf4 provides and symlink /usr/bin/dnf4 -> /usr/bin/dnf-3 (RHEL-82310) - usage help: don't mark mandatory option parameters as optional (RHEL-63958) - package: remote_location() takes basedir into account (RHEL-71125) - Multisig: ignore untrusted signatures if there is trusted one (RHEL-145372) - Document that local packages are not affected by versionlock (RHEL-94014) - Rename dnf4-multisig(8) manual page to dnf-multisig(8) (RHEL-117134) - Fix importing OpenPGPv6 keys (RHEL-114424) - Add multisig plugin (RHEL-100157) - reposync: Avoid multiple downloads of duplicate packages (RHEL-64320) - Fix bogus changelog entry date - Add forgotten changelog - Backport patch: "dnf copr enable" on "Asahi Fedora Linux Remix" guesses (RHEL-56143) - needs-restarting: Get boot time from systemd UnitsLoadStartTimestamp (RHEL-14900) - reposync: Respect --norepopath with --metadata-path (RHEL-40914) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 7.4.2 (#1887599) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 7.4.1 (#1755150) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - New version Resolves: rhbz#1922767 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(35network-manager): remove duplicate installkernel - feat(fips): include fips module unconditionally - fix(dracut.sh): make omit-drivers option do exact match for - feat: add openssl module - fix(35network-manager): install nftables kernel modules - fix(35network-manager): install nft binary during module - fix(dracut-install): copy xattr when use clone ioctl - feat(dracut.sh): add --add-confdir option - fix: typo in variable name - feat(fips): add support for UKIs - fix(kernel-modules): use modalias info in get_dev_module() - fix(dracut-functions.sh): convert mmcblk to the real kernel - fix(systemd): set right permissions for the machine-id file - feat(lsinitrd.sh): look for initrd in /usr/lib/modules/ - feat(dracut-init.sh): give --force-add precedence over --omit - feat(systemd): install systemd-executor - test: use -device instead of -watchdog to remove qemu - fix(fips): remove /dev/{random,urandom} pre-creation - fix(systemd): always include sg module - fix(fips): do not blindly remove /boot - fix(github): update format of labeler - fix(network-manager): add "After" dependency on dbus.service - fix(url-lib.sh): nfs_already_mounted() with trailing slash in - feat(systemd-pcrphase): introducing the systemd-pcrphase - fix(systemd-pcrphase): only include - fix(nfs): include also entries from /usr/lib/{passwd,group} - build: rebuild without an obsoleted patch - fix(network): warn on suspicious shell metacharacters in - fix(base): escape arguments in initqueue hook script Related: RHEL-170857 - fix(network-legacy): replace `echo` writes with `printf` to - fix(iscsi): replace `echo` writes with `printf` to prevent - fix(base): replace eval with safe variable indirection in Resolves: RHEL-170857 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(35network-manager): remove duplicate installkernel - feat(fips): include fips module unconditionally - fix(dracut.sh): make omit-drivers option do exact match for - feat: add openssl module - fix(35network-manager): install nftables kernel modules - fix(35network-manager): install nft binary during module - fix(dracut-install): copy xattr when use clone ioctl - feat(dracut.sh): add --add-confdir option - fix: typo in variable name - feat(fips): add support for UKIs - fix(kernel-modules): use modalias info in get_dev_module() - fix(dracut-functions.sh): convert mmcblk to the real kernel - revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless - build: rebuild without an obsoleted patch - fix(network): warn on suspicious shell metacharacters in - fix(base): escape arguments in initqueue hook script Related: RHEL-170857 - fix(network-legacy): replace `echo` writes with `printf` to - fix(iscsi): replace `echo` writes with `printf` to prevent - fix(base): replace eval with safe variable indirection in Resolves: RHEL-170857 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(35network-manager): remove duplicate installkernel - feat(fips): include fips module unconditionally - fix(dracut.sh): make omit-drivers option do exact match for - feat: add openssl module - fix(base): escape die() message in emergency hook script - fix(base): replace eval with safe variable indirection in - revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless - build: rebuild without an obsoleted patch - fix(network): warn on suspicious shell metacharacters in - fix(base): escape arguments in initqueue hook script Related: RHEL-170857 - fix(network-legacy): replace `echo` writes with `printf` to - fix(iscsi): replace `echo` writes with `printf` to prevent - fix(base): replace eval with safe variable indirection in Resolves: RHEL-170857 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(35network-manager): remove duplicate installkernel - feat(fips): include fips module unconditionally - fix(dracut.sh): make omit-drivers option do exact match for - feat: add openssl module - fix(35network-manager): install nftables kernel modules - fix(35network-manager): install nft binary during module - fix(dracut-install): copy xattr when use clone ioctl - feat(dracut.sh): add --add-confdir option - fix: typo in variable name - feat(fips): add support for UKIs - fix(kernel-modules): use modalias info in get_dev_module() - fix(dracut-functions.sh): convert mmcblk to the real kernel - fix(systemd): set right permissions for the machine-id file - feat(lsinitrd.sh): look for initrd in /usr/lib/modules/ - feat(dracut-init.sh): give --force-add precedence over --omit - feat(systemd): install systemd-executor - test: use -device instead of -watchdog to remove qemu - fix(fips): remove /dev/{random,urandom} pre-creation - fix(systemd): always include sg module - fix(fips): do not blindly remove /boot - fix(github): update format of labeler - fix(network-manager): add "After" dependency on dbus.service - fix(url-lib.sh): nfs_already_mounted() with trailing slash in - feat(systemd-pcrphase): introducing the systemd-pcrphase - fix(systemd-pcrphase): only include - fix(nfs): include also entries from /usr/lib/{passwd,group} - build: rebuild without an obsoleted patch - fix(network): warn on suspicious shell metacharacters in - fix(base): escape arguments in initqueue hook script Related: RHEL-170857 - fix(network-legacy): replace `echo` writes with `printf` to - fix(iscsi): replace `echo` writes with `printf` to prevent - fix(base): replace eval with safe variable indirection in Resolves: RHEL-170857 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(35network-manager): remove duplicate installkernel - feat(fips): include fips module unconditionally - fix(dracut.sh): make omit-drivers option do exact match for - feat: add openssl module - fix(35network-manager): install nftables kernel modules - fix(35network-manager): install nft binary during module - fix(dracut-install): copy xattr when use clone ioctl - feat(dracut.sh): add --add-confdir option - fix: typo in variable name - feat(fips): add support for UKIs - fix(kernel-modules): use modalias info in get_dev_module() - fix(dracut-functions.sh): convert mmcblk to the real kernel - revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless - build: rebuild without an obsoleted patch - fix(network): warn on suspicious shell metacharacters in - fix(base): escape arguments in initqueue hook script Related: RHEL-170857 - fix(network-legacy): replace `echo` writes with `printf` to - fix(iscsi): replace `echo` writes with `printf` to prevent - fix(base): replace eval with safe variable indirection in Resolves: RHEL-170857 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(35network-manager): remove duplicate installkernel - feat(fips): include fips module unconditionally - fix(dracut.sh): make omit-drivers option do exact match for - feat: add openssl module - fix(base): escape die() message in emergency hook script - fix(base): replace eval with safe variable indirection in - revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless - build: rebuild without an obsoleted patch - fix(network): warn on suspicious shell metacharacters in - fix(base): escape arguments in initqueue hook script Related: RHEL-170857 - fix(network-legacy): replace `echo` writes with `printf` to - fix(iscsi): replace `echo` writes with `printf` to prevent - fix(base): replace eval with safe variable indirection in Resolves: RHEL-170857 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(35network-manager): remove duplicate installkernel - feat(fips): include fips module unconditionally - fix(dracut.sh): make omit-drivers option do exact match for - feat: add openssl module - fix(35network-manager): install nftables kernel modules - fix(35network-manager): install nft binary during module - fix(dracut-install): copy xattr when use clone ioctl - feat(dracut.sh): add --add-confdir option - fix: typo in variable name - feat(fips): add support for UKIs - fix(kernel-modules): use modalias info in get_dev_module() - fix(dracut-functions.sh): convert mmcblk to the real kernel - fix(systemd): set right permissions for the machine-id file - feat(lsinitrd.sh): look for initrd in /usr/lib/modules/ - feat(dracut-init.sh): give --force-add precedence over --omit - feat(systemd): install systemd-executor - test: use -device instead of -watchdog to remove qemu - fix(fips): remove /dev/{random,urandom} pre-creation - fix(systemd): always include sg module - fix(fips): do not blindly remove /boot - fix(github): update format of labeler - fix(network-manager): add "After" dependency on dbus.service - fix(url-lib.sh): nfs_already_mounted() with trailing slash in - feat(systemd-pcrphase): introducing the systemd-pcrphase - fix(systemd-pcrphase): only include - fix(nfs): include also entries from /usr/lib/{passwd,group} - build: rebuild without an obsoleted patch - fix(network): warn on suspicious shell metacharacters in - fix(base): escape arguments in initqueue hook script Related: RHEL-170857 - fix(network-legacy): replace `echo` writes with `printf` to - fix(iscsi): replace `echo` writes with `printf` to prevent - fix(base): replace eval with safe variable indirection in Resolves: RHEL-170857 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(35network-manager): remove duplicate installkernel - feat(fips): include fips module unconditionally - fix(dracut.sh): make omit-drivers option do exact match for - feat: add openssl module - fix(35network-manager): install nftables kernel modules - fix(35network-manager): install nft binary during module - fix(dracut-install): copy xattr when use clone ioctl - feat(dracut.sh): add --add-confdir option - fix: typo in variable name - feat(fips): add support for UKIs - fix(kernel-modules): use modalias info in get_dev_module() - fix(dracut-functions.sh): convert mmcblk to the real kernel - revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless - build: rebuild without an obsoleted patch - fix(network): warn on suspicious shell metacharacters in - fix(base): escape arguments in initqueue hook script Related: RHEL-170857 - fix(network-legacy): replace `echo` writes with `printf` to - fix(iscsi): replace `echo` writes with `printf` to prevent - fix(base): replace eval with safe variable indirection in Resolves: RHEL-170857 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(35network-manager): remove duplicate installkernel - feat(fips): include fips module unconditionally - fix(dracut.sh): make omit-drivers option do exact match for - feat: add openssl module - fix(base): escape die() message in emergency hook script - fix(base): replace eval with safe variable indirection in - revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless - build: rebuild without an obsoleted patch - fix(network): warn on suspicious shell metacharacters in - fix(base): escape arguments in initqueue hook script Related: RHEL-170857 - fix(network-legacy): replace `echo` writes with `printf` to - fix(iscsi): replace `echo` writes with `printf` to prevent - fix(base): replace eval with safe variable indirection in Resolves: RHEL-170857 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(35network-manager): remove duplicate installkernel - feat(fips): include fips module unconditionally - fix(dracut.sh): make omit-drivers option do exact match for - feat: add openssl module - fix(35network-manager): install nftables kernel modules - fix(35network-manager): install nft binary during module - fix(dracut-install): copy xattr when use clone ioctl - feat(dracut.sh): add --add-confdir option - fix: typo in variable name - feat(fips): add support for UKIs - fix(kernel-modules): use modalias info in get_dev_module() - fix(dracut-functions.sh): convert mmcblk to the real kernel - fix(systemd): set right permissions for the machine-id file - feat(lsinitrd.sh): look for initrd in /usr/lib/modules/ - feat(dracut-init.sh): give --force-add precedence over --omit - feat(systemd): install systemd-executor - test: use -device instead of -watchdog to remove qemu - fix(fips): remove /dev/{random,urandom} pre-creation - fix(systemd): always include sg module - fix(fips): do not blindly remove /boot - fix(github): update format of labeler - fix(network-manager): add "After" dependency on dbus.service - fix(url-lib.sh): nfs_already_mounted() with trailing slash in - feat(systemd-pcrphase): introducing the systemd-pcrphase - fix(systemd-pcrphase): only include - fix(nfs): include also entries from /usr/lib/{passwd,group} - build: rebuild without an obsoleted patch - fix(network): warn on suspicious shell metacharacters in - fix(base): escape arguments in initqueue hook script Related: RHEL-170857 - fix(network-legacy): replace `echo` writes with `printf` to - fix(iscsi): replace `echo` writes with `printf` to prevent - fix(base): replace eval with safe variable indirection in Resolves: RHEL-170857 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(35network-manager): remove duplicate installkernel - feat(fips): include fips module unconditionally - fix(dracut.sh): make omit-drivers option do exact match for - feat: add openssl module - fix(35network-manager): install nftables kernel modules - fix(35network-manager): install nft binary during module - fix(dracut-install): copy xattr when use clone ioctl - feat(dracut.sh): add --add-confdir option - fix: typo in variable name - feat(fips): add support for UKIs - fix(kernel-modules): use modalias info in get_dev_module() - fix(dracut-functions.sh): convert mmcblk to the real kernel - revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless - build: rebuild without an obsoleted patch - fix(network): warn on suspicious shell metacharacters in - fix(base): escape arguments in initqueue hook script Related: RHEL-170857 - fix(network-legacy): replace `echo` writes with `printf` to - fix(iscsi): replace `echo` writes with `printf` to prevent - fix(base): replace eval with safe variable indirection in Resolves: RHEL-170857 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(35network-manager): remove duplicate installkernel - feat(fips): include fips module unconditionally - fix(dracut.sh): make omit-drivers option do exact match for - feat: add openssl module - fix(base): escape die() message in emergency hook script - fix(base): replace eval with safe variable indirection in - revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless - build: rebuild without an obsoleted patch - fix(network): warn on suspicious shell metacharacters in - fix(base): escape arguments in initqueue hook script Related: RHEL-170857 - fix(network-legacy): replace `echo` writes with `printf` to - fix(iscsi): replace `echo` writes with `printf` to prevent - fix(base): replace eval with safe variable indirection in Resolves: RHEL-170857 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(35network-manager): remove duplicate installkernel - feat(fips): include fips module unconditionally - fix(dracut.sh): make omit-drivers option do exact match for - feat: add openssl module - fix(35network-manager): install nftables kernel modules - fix(35network-manager): install nft binary during module - fix(dracut-install): copy xattr when use clone ioctl - feat(dracut.sh): add --add-confdir option - fix: typo in variable name - feat(fips): add support for UKIs - fix(kernel-modules): use modalias info in get_dev_module() - fix(dracut-functions.sh): convert mmcblk to the real kernel - fix(systemd): set right permissions for the machine-id file - feat(lsinitrd.sh): look for initrd in /usr/lib/modules/ - feat(dracut-init.sh): give --force-add precedence over --omit - feat(systemd): install systemd-executor - test: use -device instead of -watchdog to remove qemu - fix(fips): remove /dev/{random,urandom} pre-creation - fix(systemd): always include sg module - fix(fips): do not blindly remove /boot - fix(github): update format of labeler - fix(network-manager): add "After" dependency on dbus.service - fix(url-lib.sh): nfs_already_mounted() with trailing slash in - feat(systemd-pcrphase): introducing the systemd-pcrphase - fix(systemd-pcrphase): only include - fix(nfs): include also entries from /usr/lib/{passwd,group} - build: rebuild without an obsoleted patch - fix(network): warn on suspicious shell metacharacters in - fix(base): escape arguments in initqueue hook script Related: RHEL-170857 - fix(network-legacy): replace `echo` writes with `printf` to - fix(iscsi): replace `echo` writes with `printf` to prevent - fix(base): replace eval with safe variable indirection in Resolves: RHEL-170857 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(35network-manager): remove duplicate installkernel - feat(fips): include fips module unconditionally - fix(dracut.sh): make omit-drivers option do exact match for - feat: add openssl module - fix(35network-manager): install nftables kernel modules - fix(35network-manager): install nft binary during module - fix(dracut-install): copy xattr when use clone ioctl - feat(dracut.sh): add --add-confdir option - fix: typo in variable name - feat(fips): add support for UKIs - fix(kernel-modules): use modalias info in get_dev_module() - fix(dracut-functions.sh): convert mmcblk to the real kernel - revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless - build: rebuild without an obsoleted patch - fix(network): warn on suspicious shell metacharacters in - fix(base): escape arguments in initqueue hook script Related: RHEL-170857 - fix(network-legacy): replace `echo` writes with `printf` to - fix(iscsi): replace `echo` writes with `printf` to prevent - fix(base): replace eval with safe variable indirection in Resolves: RHEL-170857 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(35network-manager): remove duplicate installkernel - feat(fips): include fips module unconditionally - fix(dracut.sh): make omit-drivers option do exact match for - feat: add openssl module - fix(base): escape die() message in emergency hook script - fix(base): replace eval with safe variable indirection in - revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless - build: rebuild without an obsoleted patch - fix(network): warn on suspicious shell metacharacters in - fix(base): escape arguments in initqueue hook script Related: RHEL-170857 - fix(network-legacy): replace `echo` writes with `printf` to - fix(iscsi): replace `echo` writes with `printf` to prevent - fix(base): replace eval with safe variable indirection in Resolves: RHEL-170857 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(35network-manager): remove duplicate installkernel - feat(fips): include fips module unconditionally - fix(dracut.sh): make omit-drivers option do exact match for - feat: add openssl module - fix(35network-manager): install nftables kernel modules - fix(35network-manager): install nft binary during module - fix(dracut-install): copy xattr when use clone ioctl - feat(dracut.sh): add --add-confdir option - fix: typo in variable name - feat(fips): add support for UKIs - fix(kernel-modules): use modalias info in get_dev_module() - fix(dracut-functions.sh): convert mmcblk to the real kernel - fix(systemd): set right permissions for the machine-id file - feat(lsinitrd.sh): look for initrd in /usr/lib/modules/ - feat(dracut-init.sh): give --force-add precedence over --omit - feat(systemd): install systemd-executor - test: use -device instead of -watchdog to remove qemu - fix(fips): remove /dev/{random,urandom} pre-creation - fix(systemd): always include sg module - fix(fips): do not blindly remove /boot - fix(github): update format of labeler - fix(network-manager): add "After" dependency on dbus.service - fix(url-lib.sh): nfs_already_mounted() with trailing slash in - feat(systemd-pcrphase): introducing the systemd-pcrphase - fix(systemd-pcrphase): only include - fix(nfs): include also entries from /usr/lib/{passwd,group} - build: rebuild without an obsoleted patch - fix(network): warn on suspicious shell metacharacters in - fix(base): escape arguments in initqueue hook script Related: RHEL-170857 - fix(network-legacy): replace `echo` writes with `printf` to - fix(iscsi): replace `echo` writes with `printf` to prevent - fix(base): replace eval with safe variable indirection in Resolves: RHEL-170857 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(35network-manager): remove duplicate installkernel - feat(fips): include fips module unconditionally - fix(dracut.sh): make omit-drivers option do exact match for - feat: add openssl module - fix(35network-manager): install nftables kernel modules - fix(35network-manager): install nft binary during module - fix(dracut-install): copy xattr when use clone ioctl - feat(dracut.sh): add --add-confdir option - fix: typo in variable name - feat(fips): add support for UKIs - fix(kernel-modules): use modalias info in get_dev_module() - fix(dracut-functions.sh): convert mmcblk to the real kernel - revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless - build: rebuild without an obsoleted patch - fix(network): warn on suspicious shell metacharacters in - fix(base): escape arguments in initqueue hook script Related: RHEL-170857 - fix(network-legacy): replace `echo` writes with `printf` to - fix(iscsi): replace `echo` writes with `printf` to prevent - fix(base): replace eval with safe variable indirection in Resolves: RHEL-170857 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - fix(35network-manager): remove duplicate installkernel - feat(fips): include fips module unconditionally - fix(dracut.sh): make omit-drivers option do exact match for - feat: add openssl module - fix(base): escape die() message in emergency hook script - fix(base): replace eval with safe variable indirection in - revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless - build: rebuild without an obsoleted patch - fix(network): warn on suspicious shell metacharacters in - fix(base): escape arguments in initqueue hook script Related: RHEL-170857 - fix(network-legacy): replace `echo` writes with `printf` to - fix(iscsi): replace `echo` writes with `printf` to prevent - fix(base): replace eval with safe variable indirection in Resolves: RHEL-170857 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded - fix(pcsc): add opensc load module file - fix(pcsc): add --disable-polkit to pcscd.service - fix(pkcs11): delete trailing dot on - fix(multipath): disable user_friendly_names with mpathconf Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322 - fix(systemd): partial backport of - fix(systemd): add missing modprobe@.service - fix: let check_vol_slaves_all return 1 when checks on all - improvement(74nvmf): lookup required NIC kernel modules for - fix(74nvmf): set root=nvmf - chore(multipath): remove `rd_NO_MULTIPATH` kernel command - refactor(multipath): remove custom multipathd.service - fix(systemd): systemd.volatile needs overlayfs kernel module - refactor(dracut): introduce clamp_mtimes helper function - fix(dracut): ensure hardlink deduplication is reproducible - fix(dracut.sh): don't pass empty string as dir - fix(rescue): create hmac file for rescue kernel - ext2fs: make sure we have at least EXT2_FIRST_INO + 1 inodes - Fix: e2fsprogs: online resize fails - Related: RHEL-76095 - Bump release to perform build verification for gating changes - Related: RHEL-71250 - rebuild to incorporate libss-devel package - Related: RHEL-19059 - Change the xattr entry hash to use an unsighed char by default - Related: RHEL-10467 - ext2fs: make sure we have at least EXT2_FIRST_INO + 1 inodes - Fix: e2fsprogs: online resize fails - Related: RHEL-76095 - Bump release to perform build verification for gating changes - Related: RHEL-71250 - rebuild to incorporate libss-devel package - Related: RHEL-19059 - Change the xattr entry hash to use an unsighed char by default - Related: RHEL-10467 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Bump release - Related: #RHELMISC-9574 - Bump release - Related: #RHEL-50842 - Picked 9b9b4c7dde2e and 32cfff131279 from rhel 9.0 to update nvr - Resolves: #RHEL-50842 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - FTBFS fixes for Rawhide and ELN - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix inheritance of buildflags - Resolves: #2144520 - Bump to re-run tests; no code changes - Resolves: #2024374 - New upstream release (38) - Resolves: #2024374 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Enable Intel Control-flow Enforcement Technology (CET) Resolves: rhbz#1808811 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable debuginfod-urls - Upgrade to upstream elfutils 0.194 - Add elfutils-0.194-alloc-jobs.patch - Upgrade to upstream elfutils 0.193 - Drop upstreamed patches elfutils-0.192-fix-free.patch elfutils-0.192-libelf-static.patch elfutils-0.192-stacktrace-lto.patch - Add elfutils-0.192-fix-free.patch - Disable debuginfod-urls - Upgrade to upstream elfutils 0.194 - Add elfutils-0.194-alloc-jobs.patch - Upgrade to upstream elfutils 0.193 - Drop upstreamed patches elfutils-0.192-fix-free.patch elfutils-0.192-libelf-static.patch elfutils-0.192-stacktrace-lto.patch - Add elfutils-0.192-fix-free.patch - Disable debuginfod-urls - Upgrade to upstream elfutils 0.194 - Add elfutils-0.194-alloc-jobs.patch - Upgrade to upstream elfutils 0.193 - Drop upstreamed patches elfutils-0.192-fix-free.patch elfutils-0.192-libelf-static.patch elfutils-0.192-stacktrace-lto.patch - Add elfutils-0.192-fix-free.patch - Disable debuginfod-urls - Upgrade to upstream elfutils 0.194 - Add elfutils-0.194-alloc-jobs.patch - Upgrade to upstream elfutils 0.193 - Drop upstreamed patches elfutils-0.192-fix-free.patch elfutils-0.192-libelf-static.patch elfutils-0.192-stacktrace-lto.patch - Add elfutils-0.192-fix-free.patch - Disable debuginfod-urls - Upgrade to upstream elfutils 0.194 - Add elfutils-0.194-alloc-jobs.patch - Upgrade to upstream elfutils 0.193 - Drop upstreamed patches elfutils-0.192-fix-free.patch elfutils-0.192-libelf-static.patch elfutils-0.192-stacktrace-lto.patch - Add elfutils-0.192-fix-free.patch - fix intermittent test failures (RHEL-82109) - fix source-sh test with non-default manpath (RHEL-82109) - Rebase to environment-modules 5.3.0 (rhbz#2207885) - fix command injection in bash Tab completion (CVE-2026-85013) - fix intermittent test failures (RHEL-82109) - fix source-sh test with non-default manpath (RHEL-82109) - netlink: fix missing headers in text output. Resolves: RHEL-106540 - Update to latest upstream release v6.15. Resolves: RHEL-94954 - Upgrade to 6.11 (RHEL-60269) - Upgrade to 6.10 (RHEL-60269) - Backport fixes for issues found by OpenScanHub - Related: RHEL-7945 - Rebase to upstream v1.2.2 - Related: RHEL-15865 - Related: RHEL-14995 - Fix wrong BZ number in git log Related: rhbz#2173273 - Rebase Related: rhbz#2173273 - Fix some covscan issues - Fix memomry leak - Rebase - Fix CVE-2025-59375 - Resolves: RHEL-114643 - Fix CVE-2024-8176 - Resolves: RHEL-57489 - Fix CVE-2024-50602 - Resolves: RHEL-65066 - Fix CVE-2024-45490, CVE-2024-45491, CVE-2024-45492 - Resolves: RHEL-56761 - Resolves: RHEL-57520 - Resolves: RHEL-57511 - Fix parsing of large tokens - Reject direct parameter entity recursion - Resolves: RHEL-29699 - Resolves: RHEL-29696 - Fix CVE-2026-45186 - Resolves: RHEL-177988 - Fix CVE-2025-59375 - Resolves: RHEL-114643 - Fix CVE-2024-8176 - Resolves: RHEL-57489 - Fix CVE-2024-50602 - Resolves: RHEL-65066 - Fix CVE-2024-45490, CVE-2024-45491, CVE-2024-45492 - Resolves: RHEL-56761 - Resolves: RHEL-57520 - Resolves: RHEL-57511 - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Resolves: RHEL-221014 - Fix CVE-2026-50219 - Resolves: RHEL-220981 - Fix CVE-2026-45186 - Resolves: RHEL-177988 - Fix CVE-2025-59375 - Resolves: RHEL-114643 - Fix CVE-2024-8176 - Resolves: RHEL-57489 - Fix CVE-2024-50602 - Resolves: RHEL-65066 - Fix CVE-2024-45490, CVE-2024-45491, CVE-2024-45492 - Resolves: RHEL-56761 - Resolves: RHEL-57520 - Resolves: RHEL-57511 - Fix CVE-2026-66046: dtdCopy out-of-bounds access via isCdata hash lookup - Resolves: RHEL-260179 - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input - Resolves: RHEL-269002 - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Resolves: RHEL-221014 - Fix CVE-2026-50219 - Resolves: RHEL-220981 - Fix CVE-2026-45186 - Resolves: RHEL-177988 - Fix CVE-2025-59375 - Resolves: RHEL-114643 - Fix CVE-2024-8176 - Resolves: RHEL-57489 - Fix CVE-2024-50602 - Resolves: RHEL-65066 - Fix CVE-2024-45490, CVE-2024-45491, CVE-2024-45492 - Resolves: RHEL-56761 - Resolves: RHEL-57520 - Resolves: RHEL-57511 - CVE-2026-102633 expat: expat: Denial of Service via integer overflow in expat_realloc - Resolves: RHEL-272833 - CVE-2026-77214 expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer over-read in XML_ParseBuffer - Resolves: RHEL-277510 - Fix CVE-2026-66046: dtdCopy out-of-bounds access via isCdata hash lookup - Resolves: RHEL-260179 - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input - Resolves: RHEL-269002 - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Resolves: RHEL-221014 - Fix CVE-2026-50219 - Resolves: RHEL-220981 - Fix CVE-2026-45186 - Resolves: RHEL-177988 - Fix CVE-2025-59375 - Resolves: RHEL-114643 - Fix CVE-2024-8176 - Resolves: RHEL-57489 - Fix CVE-2024-50602 - Resolves: RHEL-65066 - upstream 1.0.34 - drop gcc warning diabling patch, upstream fixes exist for these issues now - #1961180 FCoE interface name regressions - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - add in RHEL conditional for removed fcoe.ko support - drop any differences with upstream service and config files - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable fatal diagnostic from gcc-11 for fping - Disable fatal diagnostics from gcc-11 for fipvlan - FTBFS: fix gcc 10.2 truncation and overflow errors - rebase to 1.0.33+ from new upstream location - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fix TypeError: 'NoneType' object is not callable in magic.close() Resolves: RHEL-136523 - Fix TypeError: 'NoneType' object is not callable in magic.close() Resolves: RHEL-136523 - Fixing gating.yaml - Update fmf plans and gating - Add ownership of /etc/default, /usr/share/X11/fonts, /usr/share/fish, /usr/share/zsh - Improve directory creation to avoid 'Argument list too long' error Resolves: RHEL-35327 Resolves: RHEL-1337 Resolves: RHEL-1338 - fix autofs patch when stat was not performed (RHEL-45721) - fix find not obeying option -ignore_readdir_race in symlink_loop (#2232519) - fix(policy): allow-host-ipv6: allow MLD packets - fix(server): load firewall rules before claiming dbus - fix(nftables): ipset: add entries from GLib loop when idle - fix(systemd): Requires dbus - feat: add iperf{2,3} services - fix(policy): rich: verify ipset exists - fix(systemd): allow start code 251 (RUNNING_BUT_FAILED) - fix(fw): start: remove ipset probe - fix(systemd): verify firewalld is responsive to dbus - test: add scale keyword to scale tests - test(functions): fix iptables normalization for opt field - feat(service): (x)rootd file server - fix(zone): forward: support timeout - fix(policy): support timeouts - fix(policy): allow-host-ipv6: allow MLD packets - fix(server): load firewall rules before claiming dbus - fix(nftables): ipset: add entries from GLib loop when idle - fix(systemd): Requires dbus - feat: add iperf{2,3} services - fix(policy): rich: verify ipset exists - fix(systemd): allow start code 251 (RUNNING_BUT_FAILED) - fix(fw): start: remove ipset probe - fix(systemd): verify firewalld is responsive to dbus - test: add scale keyword to scale tests - test(functions): fix iptables normalization for opt field - fix(policy): use PK_ACTION_CONFIG for set{ZoneSettings2,PolicySettings} (CVE-2026-4948) - fix(zone): forward: support timeout - fix(policy): support timeouts - fix(policy): allow-host-ipv6: allow MLD packets - fix(server): load firewall rules before claiming dbus - fix(nftables): ipset: add entries from GLib loop when idle - fix(systemd): Requires dbus - feat: add iperf{2,3} services - fix(policy): rich: verify ipset exists - fix(systemd): allow start code 251 (RUNNING_BUT_FAILED) - fix(fw): start: remove ipset probe - fix(systemd): verify firewalld is responsive to dbus - test: add scale keyword to scale tests - fix(policy): allow-host-ipv6: allow MLD packets - fix(server): load firewall rules before claiming dbus - fix(nftables): ipset: add entries from GLib loop when idle - fix(systemd): Requires dbus - feat: add iperf{2,3} services - fix(policy): rich: verify ipset exists - fix(systemd): allow start code 251 (RUNNING_BUT_FAILED) - fix(fw): start: remove ipset probe - fix(systemd): verify firewalld is responsive to dbus - test: add scale keyword to scale tests - test(functions): fix iptables normalization for opt field - feat(service): (x)rootd file server - fix(zone): forward: support timeout - fix(policy): support timeouts - fix(policy): allow-host-ipv6: allow MLD packets - fix(server): load firewall rules before claiming dbus - fix(nftables): ipset: add entries from GLib loop when idle - fix(systemd): Requires dbus - feat: add iperf{2,3} services - fix(policy): rich: verify ipset exists - fix(systemd): allow start code 251 (RUNNING_BUT_FAILED) - fix(fw): start: remove ipset probe - fix(systemd): verify firewalld is responsive to dbus - test: add scale keyword to scale tests - test(functions): fix iptables normalization for opt field - fix(policy): use PK_ACTION_CONFIG for set{ZoneSettings2,PolicySettings} (CVE-2026-4948) - fix(zone): forward: support timeout - fix(policy): support timeouts - fix(policy): allow-host-ipv6: allow MLD packets - fix(server): load firewall rules before claiming dbus - fix(nftables): ipset: add entries from GLib loop when idle - fix(systemd): Requires dbus - feat: add iperf{2,3} services - fix(policy): rich: verify ipset exists - fix(systemd): allow start code 251 (RUNNING_BUT_FAILED) - fix(fw): start: remove ipset probe - fix(systemd): verify firewalld is responsive to dbus - test: add scale keyword to scale tests - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Insert Epoch in Requires/Provides/Obsoletes - Revert to 2.0.5 - 3.0.3-1 🐞 Fix bugs in the 3.0.2 refactoring - 3.0.2-1 🐞 Workaround Fedora problems created by rpm commit 93604e2 harder - 3.0.1-1 🐞 Workaround Fedora problems created by rpm commit 93604e2 - 2.0.5-1 ✅ do not add empty urls to appstream files - 2.0.4-2 ✅ validate fontconfig files by default - Fix for CVE-2025-27363 out-of-bound write vulnerability - Patch initially by Marc Deslauriers of Canonical - https://www.openwall.com/lists/oss-security/2025/03/14/3 - Adjusted for EL9 by Jonathan Wright of AlmaLinux - and a member of the Meta security team - Resolves: RHEL-83105 - Bump release to test gating Related: RHEL-69609 - null-terminate buffer in fuse_req_getgroups() - libfuse: null-terminate buffer in fuse_req_getgroups() - Advertise support of FUSE_PARALLEL_DIROPS to kernel - Related: RHEL-24721 - Synchronize expire-only API with upstream. - Related: RHEL-23414 - Fix feature_notify_inode_expire_only related(rhbz#2188182) - Bump release to test gating Related: RHEL-69609 - null-terminate buffer in fuse_req_getgroups() - Use AlmaLinux cert - Rebase to get new hardware support - Resolves: #RHEL-125778 - Rebase to get new hardware support - Resolves: #RHEL-82423 - Rebase to get new hardware support - Resolves: #RHEL-82423 - Rebase to get hardware support for CERTPX-13842 - Resolves: #RHEL-16637 - Resolves: #RHEL-35373 - Resolves: #RHEL-61930 Fix the issue with incorect handling of return values of some processes Resolves: rhbz#2055107 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - New upstream release - Split the package into the main package and locales subpackage - Fix use after free in io.c - Fix buffer overflow in extensions/readdir.c - Fix integer overflow in buildin.c Resolves: CVE-2026-40467 Resolves: CVE-2026-40468 Resolves: CVE-2026-40553 - Update to 1.23 - add Java 17 support patch from Mamoru Tasaka (rhbz#2182696) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gettext-0.21-covscan.patch to fix issues detected by static analyzers Add gettext-0.21-disable-libtextstyle.patch Do not build libtextstyle, as it depends on libcroco which is now unmaintained and has known security bugs. Obsolete libtextstyle and libtextstyle-devel packages. - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - add Java 17 support patch from Mamoru Tasaka (rhbz#2182696) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gettext-0.21-covscan.patch to fix issues detected by static analyzers Add gettext-0.21-disable-libtextstyle.patch Do not build libtextstyle, as it depends on libcroco which is now unmaintained and has known security bugs. Obsolete libtextstyle and libtextstyle-devel packages. - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Recommends: libproxy-webkitgtk4 for glib-pacrunner - Related: #2056988 - Reenable libproxy dependency - Resolves: #2056988 - Update to 2.68.3 - Resolves: #1947187 - Update to 2.68.2 - Resolves: #1993765 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Disable libproxy in RHEL - Resolves: #1968554 - Update to 2.68.1 - Resolves: #1947188 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 2.68.0 - Update to 2.68.rc - Add patch for CVE-2025-14087 and CVE-2025-14512 - Add patch for CVE-2025-13601 - Fix GUnixMount issues - gdbusconnection: Prevent sending a serial of zero on overflow - Resolves: RHEL-114059 - Add patches for CVE-2024-52533 and CVE-2025-4373 - Update GDateTime test for new tzdata - Resolves: RHEL-94483 - Resolves: RHEL-102844 - Add support for x-gvfs-trash mount option - Resolves: RHEL-52360 - Fix CVE-2024-34397, signal subscription vulnerabilities - Resolves: RHEL-35775 - Fix CVE-2026-16118: heap-buffer-overflow in xdgmimemagic.c - Fix CVE-2026-15588: limit D-Bus auth line read length - Fix CVE-2026-58010: off-by-one in GVariant tuple offset checking - Resolves: RHEL-212157 - Fix CVE-2026-58012: buffer overflow in gregex.c with G_REGEX_RAW - Resolves: RHEL-212217 - Fix CVE-2026-58011: range validation in g_date_time_add_full() - Resolves: RHEL-212194 - Fix CVE-2026-58013: buffer over-read in GIOChannel with long terminators - Resolves: RHEL-212236 - Fix CVE-2026-58014: heap under-read in g_key_file_get_locale_string_list - Resolves: RHEL-190589 - Fix CVE-2026-58015: validate D-Bus DBUS_COOKIE_SHA1 cookie context - Resolves: RHEL-212261 - Fix CVE-2026-58016: broken node element nesting validation in D-Bus introspection XML parsing - Resolves: RHEL-190632 - Add patch for CVE-2025-14087 and CVE-2025-14512 - Fix CVE-2026-58016: broken node element nesting validation in D-Bus introspection XML parsing - Resolves: RHEL-190632 - Add patch for CVE-2025-14087 and CVE-2025-14512 - Add patch for CVE-2025-13601 - Fix GUnixMount issues - gdbusconnection: Prevent sending a serial of zero on overflow - Resolves: RHEL-114059 - Add patches for CVE-2024-52533 and CVE-2025-4373 - Update GDateTime test for new tzdata - Resolves: RHEL-94483 - Resolves: RHEL-102844 - Add support for x-gvfs-trash mount option - Resolves: RHEL-52360 - Fix CVE-2026-15588: limit D-Bus auth line read length - Fix CVE-2026-58010: off-by-one in GVariant tuple offset checking - Resolves: RHEL-212157 - Fix CVE-2026-58012: buffer overflow in gregex.c with G_REGEX_RAW - Resolves: RHEL-212217 - Fix CVE-2026-58011: range validation in g_date_time_add_full() - Resolves: RHEL-212194 - Fix CVE-2026-58013: buffer over-read in GIOChannel with long terminators - Resolves: RHEL-212236 - Fix CVE-2026-58014: heap under-read in g_key_file_get_locale_string_list - Resolves: RHEL-190589 - Fix CVE-2026-58015: validate D-Bus DBUS_COOKIE_SHA1 cookie context - Resolves: RHEL-212261 - Fix CVE-2026-58016: broken node element nesting validation in D-Bus introspection XML parsing - Resolves: RHEL-190632 - Add patch for CVE-2025-14087 and CVE-2025-14512 - Add patch for CVE-2025-13601 - Fix GUnixMount issues - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix: previous commit removed one function from the library and thus broke the ABI - function gmpn_preinv_divrem_1 should now not be removed Related: rhbz#2044216 - Add SIMD optimization patches for s390x (provided by the IBM) Resolves: rhbz#2044216 Fix: Integer overflow and resultant buffer overflow via crafted input Resolves: CVE-2021-43618 - Add the support for intel CET Resolves: rhbz#1977890 - Move the .hmac files to the fipscheck subfolder - Make symlinks from their original location (Fedora contains the .hmac files there) pointing to their new location Resolves: rhbz#1980758 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fix CVE-2025-68973 (gpg.fail/memcpy) - Fix PKCS#11 token initialization label overflow (CVE-2025-9820) - Fix name constraint processing performance issue (CVE-2025-14831) - Reinstate and update the prematurely dropped rekeying patch - Rebase to 3.8.10 - Revert defaulting to PBMAC1 in FIPS mode - Revert unapproving 1024-, 1280-, 1536- and 1792-bit RSA verification - key_update: rework the rekeying logic (RHEL-107499) - Add missing changelog entry - Fix CVE-2025-32988, CVE-2025-32989, CVE-2025-32990, and CVE-2025-6395 - Bump nettle dependency to 3.10.1 (RHEL-52740) - Backport the fix for CVE-2024-12243 (RHEL-78580) - Bump release to ensure el9 package is greater than el9_* packages - Bump release to ensure el9 package is greater than el9_* packages - Fix CVE-2026-33846 (DTLS fragment reassembly, High, heap overwrite) - Fix CVE-2026-42009 (DTLS fragment reassembly, High, undefined behaviour) - Fix CVE-2026-33845 (DTLS fragment reassembly, High, heap overread) - Fix CVE-2026-42010 (PSK authentication, High, authentication bypass) - Fix CVE-2026-3833 (Name constraints, Medium, name constraint bypass) - Fix CVE-2026-42011 (Name constraints, Medium, name constraint bypass) - Fix CVE-2026-42012 (CN fallback, Medium, certificate misuse) - Fix CVE-2026-42013 (CN fallback, Medium, certificate misuse) - Fix CVE-2026-42014 (PKCS#11 PIN change, Medium, use-after-free) - Fix CVE-2026-5260 (PKCS#11 RSA, Medium, heap overread) - Fix CVE-2026-42015 (PKCS#12 appending, Low, heap overwrite) - Fix CVE-2026-3832 (OCSP, Low, revocation bypass) - Fix CVE-2026-5419 (PKCS#7, Low, timing side-channel) - Fix upstream security issue #1808 (PSK rehandshake) - Fix upstream security issue #1810 (EKU OID prefix match) - Fix upstream security issue #1813 (pkcs11-provider persistent keys) - Fix upstream security issue #1818 (RSA correctness, OpenSSL format import) - Fix upstream security issue #1819 (PKCS#11 trust removal error path) - Fix upstream security issue #1822 (SCT extension parser OOB read) - Fix upstream security issue #1841 (key zeroization in hybrid kex) - Fix upstream security issue #1823 (malformed certtool template) - Fix upstream security issue #1817 (session parameter loading robustness) - Fix upstream security issue #1820 (PKCS#11 KDF succeeding w/o deriving) - gnutls-3.8.10-CVE-2025-9820.patch: update Makefile.in - Fix PKCS#11 token initialization label overflow (CVE-2025-9820) - Fix name constraint processing performance issue (CVE-2025-14831) - Reinstate and update the prematurely dropped rekeying patch - Rebase to 3.8.10 - Revert defaulting to PBMAC1 in FIPS mode - Revert unapproving 1024-, 1280-, 1536- and 1792-bit RSA verification - key_update: rework the rekeying logic (RHEL-107499) - Add missing changelog entry - Fix CVE-2025-32988, CVE-2025-32989, CVE-2025-32990, and CVE-2025-6395 - Bump nettle dependency to 3.10.1 (RHEL-52740) - Backport the fix for CVE-2024-12243 (RHEL-78580) - Rebuild to target RHEL-9.8 - fips: Allow SigVer only with RSA keys with modulus >= 2048 bits - Fix order of previous changelog entries (RHEL-172270) - Use full hash+sign operations in pct_test (RHEL-172270) - Fix CVE-2026-33846 (DTLS fragment reassembly, High, heap overwrite) - Fix CVE-2026-42009 (DTLS fragment reassembly, High, undefined behaviour) - Fix CVE-2026-33845 (DTLS fragment reassembly, High, heap overread) - Fix CVE-2026-42010 (PSK authentication, High, authentication bypass) - Fix CVE-2026-3833 (Name constraints, Medium, name constraint bypass) - Fix CVE-2026-42011 (Name constraints, Medium, name constraint bypass) - Fix CVE-2026-42012 (CN fallback, Medium, certificate misuse) - Fix CVE-2026-42013 (CN fallback, Medium, certificate misuse) - Fix CVE-2026-42014 (PKCS#11 PIN change, Medium, use-after-free) - Fix CVE-2026-5260 (PKCS#11 RSA, Medium, heap overread) - Fix CVE-2026-42015 (PKCS#12 appending, Low, heap overwrite) - Fix CVE-2026-3832 (OCSP, Low, revocation bypass) - Fix CVE-2026-5419 (PKCS#7, Low, timing side-channel) - Fix upstream security issue #1808 (PSK rehandshake) - Fix upstream security issue #1810 (EKU OID prefix match) - Fix upstream security issue #1813 (pkcs11-provider persistent keys) - Fix upstream security issue #1818 (RSA correctness, OpenSSL format import) - Fix upstream security issue #1819 (PKCS#11 trust removal error path) - Fix upstream security issue #1822 (SCT extension parser OOB read) - Fix upstream security issue #1841 (key zeroization in hybrid kex) - Fix upstream security issue #1823 (malformed certtool template) - Fix upstream security issue #1817 (session parameter loading robustness) - Fix upstream security issue #1820 (PKCS#11 KDF succeeding w/o deriving) - gnutls-3.8.10-CVE-2025-9820.patch: update Makefile.in - Fix PKCS#11 token initialization label overflow (CVE-2025-9820) - Fix name constraint processing performance issue (CVE-2025-14831) - Reinstate and update the prematurely dropped rekeying patch - Rebase to 3.8.10 - Revert defaulting to PBMAC1 in FIPS mode - Revert unapproving 1024-, 1280-, 1536- and 1792-bit RSA verification - key_update: rework the rekeying logic (RHEL-107499) - Add missing changelog entry - Mark ML-KEM FIPS-unapproved (RHEL-250213) - Rebuild to target RHEL-9.8 - fips: Allow SigVer only with RSA keys with modulus >= 2048 bits - Fix order of previous changelog entries (RHEL-172270) - Use full hash+sign operations in pct_test (RHEL-172270) - Fix CVE-2026-33846 (DTLS fragment reassembly, High, heap overwrite) - Fix CVE-2026-42009 (DTLS fragment reassembly, High, undefined behaviour) - Fix CVE-2026-33845 (DTLS fragment reassembly, High, heap overread) - Fix CVE-2026-42010 (PSK authentication, High, authentication bypass) - Fix CVE-2026-3833 (Name constraints, Medium, name constraint bypass) - Fix CVE-2026-42011 (Name constraints, Medium, name constraint bypass) - Fix CVE-2026-42012 (CN fallback, Medium, certificate misuse) - Fix CVE-2026-42013 (CN fallback, Medium, certificate misuse) - Fix CVE-2026-42014 (PKCS#11 PIN change, Medium, use-after-free) - Fix CVE-2026-5260 (PKCS#11 RSA, Medium, heap overread) - Fix CVE-2026-42015 (PKCS#12 appending, Low, heap overwrite) - Fix CVE-2026-3832 (OCSP, Low, revocation bypass) - Fix CVE-2026-5419 (PKCS#7, Low, timing side-channel) - Fix upstream security issue #1808 (PSK rehandshake) - Fix upstream security issue #1810 (EKU OID prefix match) - Fix upstream security issue #1813 (pkcs11-provider persistent keys) - Fix upstream security issue #1818 (RSA correctness, OpenSSL format import) - Fix upstream security issue #1819 (PKCS#11 trust removal error path) - Fix upstream security issue #1822 (SCT extension parser OOB read) - Fix upstream security issue #1841 (key zeroization in hybrid kex) - Fix upstream security issue #1823 (malformed certtool template) - Fix upstream security issue #1817 (session parameter loading robustness) - Fix upstream security issue #1820 (PKCS#11 KDF succeeding w/o deriving) - gnutls-3.8.10-CVE-2025-9820.patch: update Makefile.in - Fix PKCS#11 token initialization label overflow (CVE-2025-9820) - Fix name constraint processing performance issue (CVE-2025-14831) - Reinstate and update the prematurely dropped rekeying patch - Rebase to 3.8.10 - Revert defaulting to PBMAC1 in FIPS mode - Revert unapproving 1024-, 1280-, 1536- and 1792-bit RSA verification - key_update: rework the rekeying logic (RHEL-107499) - Fix FTBFS for a possible Meson rebase - Resolves: rhbz#2140108 - Change Conflicts syntax (#1915339) - Add Conflicts for i686/x86_64 devel subpackage (#1915339) - Rebuilt for libffi 3.4.2 SONAME transition. Related: rhbz#1891914 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add Requires on python-markdown for g-ir-doc-tool (#1979144) - Add license texts and documentation files (#1979144) - Rebuild Resolves: #2035319 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fix license and covscan issues Resolves: #1938732 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Stop building the HTML manual, texlive is breaking things too frequently. - Adapt to new cmake macros. - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Add missing build dependencies for building the manual with TeXLive 2020. - Update to version 1.3.14. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fixed stack overflow detection Resolves: rhbz#1975156 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New version Resolves: rhbz#1895797 - New version Resolves: rhbz#1883086 - Backport fix for upstream #28105 to fix zgrep Resolves: rhbz#1872913 - Remove some non-portable tests that fail on armv7hl (Paul Eggert) Resolves: rhbz#1863830 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Fix several important Covscan defects resolves: #1938735 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Make psutils a weak dependency - Add psutils as a runtime dependency (needed for groff -Thtml) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Move pdfpic.tmac to groff-base resolves: #1888370 - Use make macros - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to version 1.22.4 resolves: #1808072 - Debrand for AlmaLinux - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148310 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146555 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24742 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24742 - Fix several security issues about module unloading and file handling - Resolved: #RHEL-141594 - Resolves: #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - rpminspect: disable abidiff inspections - Resolves: #RHEL-106446 - appendedsig: Fix grub-mkimage with an unaligned appended signature size - Related: #RHEL-24742 - ieee1275: Upstream patches for appended signature support - Related: #RHEL-24742 - spec: Update RHEL x86_64 and aarch64 signing key to redhatsecureboot802 - Resolves: #RHEL-126136 - Debrand for AlmaLinux - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148310 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146555 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24742 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24742 - Fix several security issues about module unloading and file handling - Resolved: #RHEL-141594 - Resolves: #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - rpminspect: disable abidiff inspections - Resolves: #RHEL-106446 - appendedsig: Fix grub-mkimage with an unaligned appended signature size - Related: #RHEL-24742 - ieee1275: Upstream patches for appended signature support - Related: #RHEL-24742 - spec: Update RHEL x86_64 and aarch64 signing key to redhatsecureboot802 - Resolves: #RHEL-126136 - Debrand for AlmaLinux - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148310 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146555 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24742 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24742 - Fix several security issues about module unloading and file handling - Resolved: #RHEL-141594 - Resolves: #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - rpminspect: disable abidiff inspections - Resolves: #RHEL-106446 - appendedsig: Fix grub-mkimage with an unaligned appended signature size - Related: #RHEL-24742 - ieee1275: Upstream patches for appended signature support - Related: #RHEL-24742 - spec: Update RHEL x86_64 and aarch64 signing key to redhatsecureboot802 - Resolves: #RHEL-126136 - Debrand for AlmaLinux - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148310 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146555 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24742 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24742 - Fix several security issues about module unloading and file handling - Resolved: #RHEL-141594 - Resolves: #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - rpminspect: disable abidiff inspections - Resolves: #RHEL-106446 - appendedsig: Fix grub-mkimage with an unaligned appended signature size - Related: #RHEL-24742 - ieee1275: Upstream patches for appended signature support - Related: #RHEL-24742 - spec: Update RHEL x86_64 and aarch64 signing key to redhatsecureboot802 - Resolves: #RHEL-126136 - Debrand for AlmaLinux - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148310 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146555 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24742 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24742 - Fix several security issues about module unloading and file handling - Resolved: #RHEL-141594 - Resolves: #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - rpminspect: disable abidiff inspections - Resolves: #RHEL-106446 - appendedsig: Fix grub-mkimage with an unaligned appended signature size - Related: #RHEL-24742 - ieee1275: Upstream patches for appended signature support - Related: #RHEL-24742 - spec: Update RHEL x86_64 and aarch64 signing key to redhatsecureboot802 - Resolves: #RHEL-126136 - Debrand for AlmaLinux - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148310 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146555 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24742 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24742 - Fix several security issues about module unloading and file handling - Resolved: #RHEL-141594 - Resolves: #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - rpminspect: disable abidiff inspections - Resolves: #RHEL-106446 - appendedsig: Fix grub-mkimage with an unaligned appended signature size - Related: #RHEL-24742 - ieee1275: Upstream patches for appended signature support - Related: #RHEL-24742 - spec: Update RHEL x86_64 and aarch64 signing key to redhatsecureboot802 - Resolves: #RHEL-126136 - Debrand for AlmaLinux - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148310 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146555 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24742 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24742 - Fix several security issues about module unloading and file handling - Resolved: #RHEL-141594 - Resolves: #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - rpminspect: disable abidiff inspections - Resolves: #RHEL-106446 - appendedsig: Fix grub-mkimage with an unaligned appended signature size - Related: #RHEL-24742 - ieee1275: Upstream patches for appended signature support - Related: #RHEL-24742 - spec: Update RHEL x86_64 and aarch64 signing key to redhatsecureboot802 - Resolves: #RHEL-126136 - Debrand for AlmaLinux - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148310 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146555 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24742 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24742 - Fix several security issues about module unloading and file handling - Resolved: #RHEL-141594 - Resolves: #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - rpminspect: disable abidiff inspections - Resolves: #RHEL-106446 - appendedsig: Fix grub-mkimage with an unaligned appended signature size - Related: #RHEL-24742 - ieee1275: Upstream patches for appended signature support - Related: #RHEL-24742 - spec: Update RHEL x86_64 and aarch64 signing key to redhatsecureboot802 - Resolves: #RHEL-126136 - grubby-bls: in s390* systems, run zipl on grub cfg update event Resolves: #RHEL-106612 - Update cfg when setting a default kernel Resolves: #RHEL-106612 - Bump NVR - Related: #RHEL-61421 - grubby-bls: on PPC systems, remove petiboot's version checks - Resolves: #RHEL-61421 - On grub cfg updates, run grub2-mkconfig for Xen systems Resolves: #RHEL-50691 - Do not overwrite all vars that start with GRUB_CMDLINE_LINUX - Resolves: #RHEL-21301 - Add an option to disable showing password entry at login/lockscreen Resolves: RHEL-123140 - Add an option to enable restart/shutdown at lockscreen Resolves: RHEL-103998 - Fix various issues detected by static analysis Resolves: RHEL-51177 - Use openldap-servers from EPEL repo for testing - Resolves: rhbz#2187634 - Add an option for minimum lifetime - Resolves: rhbz#2184333 - Remove unused patch files - Fix date typographical error in changelog - Rebase to gzip 1.12 - Resolves an arbitrary-file-write vulnerability in zgrep Resolves: rhbz#2073343 Resolves: rhbz#1870675 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add the ibm patches dealing with s390x optimizations Resolves: rhbz#1986357 - Add gating tests Resolves: rhbz#1986357 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fix an issue with a temporary file creations when mktemp is missing (41991) - Fix a global buffer overflow vulnerability in the LZH decompression logic (41992) Resolves: CVE-2026-41991 Resolves: CVE-2026-41992 - Resolves:RHEL-2268 Fix CI tests results - Resolves:RHEL-2268 CVE-2023-25193 - Resolves:rh#2103849 - Update tests.yaml - Resolves:rh#2103849 CVE-2022-33068 - Fix Covscan compiler warning for inclusion of parenthesis - Update tests.yaml - Resolves:rh#2103849 CVE-2022-33068 harfbuzz: integer overflow in the component hb-ot-shape-fallback.c - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - New upstream version 9.62 (#1961841) - Fix fclose() on sysfs file write - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Move hdparm binary to /usr/sbin - New upstream version 9.60 (#1947860) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - New version 3.23 (#1771102) - New release v3.22 (#1747011) - Update pci and vendor ids Resolves: RHEL-110948 - Update pci, usb and vendor ids Resolves: RHEL-110947 - Update pci, usb and vendor ids Resolves: RHEL-78358 - Update pci, usb and vendor ids Resolves: RHEL-78355 - Update pci and vendor ids Resolves: RHEL-56969 - Update pci, usb and vendor ids Resolves: RHEL-56969 - Update pci, usb and vendor ids Resolves: RHEL-56968 - Update pci, usb and vendor ids Resolves: RHEL-27163 - Update pci, usb and vendor ids Resolves: RHEL-27162 - Update pci, usb and vendor ids Resolves: RHEL-6948 - linux: fix support for NUMA node0 being offline (RHEL-118677) - Resolves: RHEL-118677 - linux: fix support for NUMA node0 being offline (RHEL-118677) - Resolves: RHEL-118677 - Rebuilt for gating testing - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Rebase to upstream release v61.0 - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - bump release to rebuild in sidetag - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - bump release to rebuild in sidetag - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Rebase to upstream release v60.0 - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Fix pyverbs tests - Resolves: RHEL-107929, RHEL-107930 - Rebase to upstream release v57.0 - Resolves: RHEL-76570, RHEL-45644, RHEL-72077, RHEL-68506, RHEL-94449 - Fix data corruption in bnxt_re - Resolves: RHEL-89179 - Rebase to upstream release v54.0 - Resolves: RHEL-52886, RHEL-54647, RHEL-51876 - Rebase to upstream release v51.0 - Resolves: RHEL-24473, RHEL-23180 - Verify IMA signature to make sure it's correct (RHEL-105471) - Drop old libimaevm.so.4 (RHEL-82797) - ima-setup: run zipl after building initramfs for s390x (RHEL-72293) - update to upstream 1.6.2 (RHEL-82793) - Skip unsupported file systems for sample appraisal rule (RHEL-62817) - add some IMA setup tools (RHEL-33751) - Disable compat build (RHEL-2969) - Update to upstream 1.5 (RHEL-2969) - Rebuild Related: #1938884 - Rebuild Related: #1938884 - Fix issues found by static analysis Resolves: #1938884 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Fix problem in shell code found by ShellCheck in test script - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Add BR: perl(Unicode::Normalize) - add additional Provides: tex-texinfo ("it's an older code sir, but it checks out") - Release bump, no changes - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - version bump - version bump - version bump - netconsole: var/lock -> run/lock - netconsole: source sysconfig/network only if it exists - netconsole: remove unused variables - netconsole: remove trailing whitespaces - sync spec with c9s - rename_device: free path after it is used - rename_device: remove trailing whitespaces - Add -r to while read as per shellcheck - Fix splitting spaces in paths from statetab files - version bump - version bump - version bump - netconsole: var/lock -> run/lock - netconsole: source sysconfig/network only if it exists - netconsole: remove unused variables - netconsole: remove trailing whitespaces - sync spec with c9s - rename_device: free path after it is used - rename_device: remove trailing whitespaces - Add -r to while read as per shellcheck - Fix splitting spaces in paths from statetab files - version bump - version bump - version bump - netconsole: var/lock -> run/lock - netconsole: source sysconfig/network only if it exists - netconsole: remove unused variables - netconsole: remove trailing whitespaces - sync spec with c9s - rename_device: free path after it is used - rename_device: remove trailing whitespaces - Add -r to while read as per shellcheck - Fix splitting spaces in paths from statetab files - patch: Read integrity profile info from top level device. - patch: Fix possible use of uninitialized variable. - patch: Reinstate pbkdf serialization flag in device activation. - patch: Fix LUKS2 device status in inline HW mode and detached header. - patch: Set inline integrity flag if no underlying dm-integrity device. - patch: Fix wrong device size status reports in cryptsetup and integritysetup. - Resolves: RHEL-122297 RHEL-125152 RHEL-125167 RHEL-132585 RHEL-140106 - patch: Improve check for a function attribute support. - Resolves: 100089 - Update to cryptsetup 2.8.1. - Resolves: 100089 - patch: Ignore unknown VMK entry 24 in bitlk metadata. - Resolves: RHEL-94860 - Specbump for correct target release. - Resolves: RHEL-39003 RHEL-41238 - patch: Warn if Argon2 keyslot is unlocked in FIPS mode. - patch: Enable Argon2 in FIPS with openssl backend. - patch: Abort online reencryption for misconfigured devices. - patch: Harden online reencryption checks in initialization phase. - patch: Fix detection of direct-io with suspended devices. - patch: Return suspended status also for unknow target types. - patch: Do not handle device as suspended on error. - Resolves: RHEL-39003 RHEL-41238 - Update to cryptsetup 2.7.2 - Use OpenSLL Argon implementation instead of the built-in one - Resolves: RHEL-32377 - bump release for gating rebuild(#2052422) - do not show DELAY_ACCT error for non-existent pids(#2052422) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for ronn successor - Updated to 1.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Updated to 0.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Updated to 0.4.0 - Updated to 0.3.0 - iproute-6.17.0-2.el9 - iproute-6.17.0-1.el9 - iproute-6.14.0-2.el9 - iproute-6.14.0-1.el9 - image-mode: double test duration - Add image-mode testing - Add tmt test plan - Fix gating yaml - iproute-6.11.0-1.el9 - iproute-6.17.0-2.el9 - iproute-6.17.0-1.el9 - iproute-6.14.0-2.el9 - iproute-6.14.0-1.el9 - image-mode: double test duration - Add image-mode testing - Add tmt test plan - Fix gating yaml - iproute-6.11.0-1.el9 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - rebase to 2.4.19 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Bump release for gated side-tag - Fix patch "Parse port before trying by service name" - Fix for wrong comment in ipset-config file - Bump release for gated side-tag - Fix patch "Parse port before trying by service name" - Fix for wrong comment in ipset-config file - libxtables: Attenuate effects of functions' internal static buffers (Phil Sutter) [RHEL-72027] - spec: Fix build on c9s (Phil Sutter) [RHEL-72005] - spec: Explicitly remove unpackaged files (Michel Lind) [RHEL-72005] - Revert "xshared: Print protocol numbers if --numeric was given" (Phil Sutter) [RHEL-70173] - Bump release for side-tag (Phil Sutter) [RHEL-69283 RHEL-69284] - Bump release for RHEL-9.5.z (Phil Sutter) [RHEL-69283 RHEL-69284] - xtables-monitor: Ignore ebtables policy rules unless tracing (Phil Sutter) [RHEL-47264] - xtables-monitor: Fix for ebtables rule events (Phil Sutter) [RHEL-47264] - tests: shell: New xtables-monitor test (Phil Sutter) [RHEL-47264] - xtables-monitor: Support arptables chain events (Phil Sutter) [RHEL-47264] - xtables-monitor: Align builtin chain and table output (Phil Sutter) [RHEL-47264] - xtables-monitor: Flush stdout after all lines of output (Phil Sutter) [RHEL-47264] - xtables-monitor: Proper re-init for rule's family (Phil Sutter) [RHEL-47264] - nft: Fix for zeroing existent builtin chains (Phil Sutter) [RHEL-49497] - nft: cache: Annotate faked base chains as such (Phil Sutter) [RHEL-49497] - nft: Fix for zeroing non-existent builtin chains (Phil Sutter) [RHEL-49497] - spec: Simplify legacy package integration (Phil Sutter) [RHEL-5797] - extensions: libxt_sctp: Add an extra assert() (Phil Sutter) [RHEL-40928] - spec: Add symlinks for merged extension DSOs (Phil Sutter) [RHEL-32463] - nft: Fix for broken recover_rule_compat() (Phil Sutter) [RHEL-26619] - spec: Ship ebtables-translate and man page (Phil Sutter) [RHEL-32922] - ebtables: Fix corner-case noflush restore bug (Phil Sutter) [RHEL-14147] - libxtables: Attenuate effects of functions' internal static buffers (Phil Sutter) [RHEL-72027] - spec: Fix build on c9s (Phil Sutter) [RHEL-72005] - spec: Explicitly remove unpackaged files (Michel Lind) [RHEL-72005] - Revert "xshared: Print protocol numbers if --numeric was given" (Phil Sutter) [RHEL-70173] - Bump release for side-tag (Phil Sutter) [RHEL-69283 RHEL-69284] - Bump release for RHEL-9.5.z (Phil Sutter) [RHEL-69283 RHEL-69284] - xtables-monitor: Ignore ebtables policy rules unless tracing (Phil Sutter) [RHEL-47264] - xtables-monitor: Fix for ebtables rule events (Phil Sutter) [RHEL-47264] - tests: shell: New xtables-monitor test (Phil Sutter) [RHEL-47264] - xtables-monitor: Support arptables chain events (Phil Sutter) [RHEL-47264] - xtables-monitor: Align builtin chain and table output (Phil Sutter) [RHEL-47264] - xtables-monitor: Flush stdout after all lines of output (Phil Sutter) [RHEL-47264] - xtables-monitor: Proper re-init for rule's family (Phil Sutter) [RHEL-47264] - nft: Fix for zeroing existent builtin chains (Phil Sutter) [RHEL-49497] - nft: cache: Annotate faked base chains as such (Phil Sutter) [RHEL-49497] - nft: Fix for zeroing non-existent builtin chains (Phil Sutter) [RHEL-49497] - spec: Simplify legacy package integration (Phil Sutter) [RHEL-5797] - extensions: libxt_sctp: Add an extra assert() (Phil Sutter) [RHEL-40928] - spec: Add symlinks for merged extension DSOs (Phil Sutter) [RHEL-32463] - nft: Fix for broken recover_rule_compat() (Phil Sutter) [RHEL-26619] - spec: Ship ebtables-translate and man page (Phil Sutter) [RHEL-32922] - ebtables: Fix corner-case noflush restore bug (Phil Sutter) [RHEL-14147] - libxtables: Attenuate effects of functions' internal static buffers (Phil Sutter) [RHEL-72027] - spec: Fix build on c9s (Phil Sutter) [RHEL-72005] - spec: Explicitly remove unpackaged files (Michel Lind) [RHEL-72005] - Revert "xshared: Print protocol numbers if --numeric was given" (Phil Sutter) [RHEL-70173] - Bump release for side-tag (Phil Sutter) [RHEL-69283 RHEL-69284] - Bump release for RHEL-9.5.z (Phil Sutter) [RHEL-69283 RHEL-69284] - xtables-monitor: Ignore ebtables policy rules unless tracing (Phil Sutter) [RHEL-47264] - xtables-monitor: Fix for ebtables rule events (Phil Sutter) [RHEL-47264] - tests: shell: New xtables-monitor test (Phil Sutter) [RHEL-47264] - xtables-monitor: Support arptables chain events (Phil Sutter) [RHEL-47264] - xtables-monitor: Align builtin chain and table output (Phil Sutter) [RHEL-47264] - xtables-monitor: Flush stdout after all lines of output (Phil Sutter) [RHEL-47264] - xtables-monitor: Proper re-init for rule's family (Phil Sutter) [RHEL-47264] - nft: Fix for zeroing existent builtin chains (Phil Sutter) [RHEL-49497] - nft: cache: Annotate faked base chains as such (Phil Sutter) [RHEL-49497] - nft: Fix for zeroing non-existent builtin chains (Phil Sutter) [RHEL-49497] - spec: Simplify legacy package integration (Phil Sutter) [RHEL-5797] - extensions: libxt_sctp: Add an extra assert() (Phil Sutter) [RHEL-40928] - spec: Add symlinks for merged extension DSOs (Phil Sutter) [RHEL-32463] - nft: Fix for broken recover_rule_compat() (Phil Sutter) [RHEL-26619] - spec: Ship ebtables-translate and man page (Phil Sutter) [RHEL-32922] - ebtables: Fix corner-case noflush restore bug (Phil Sutter) [RHEL-14147] - New version 1.2.2 (Andrea Claudi) [RHEL-77280] - Fix buffer overflow via ifaces.c (Andrea Claudi) [RHEL-71493] - Fix CVE-2025-48964 iputils: iputils integer overflow (RHEL-112000) - arping: Fix exit code if receive more replies than sent (RHEL-98281) - Fix ping hangs under ASan on aarch64 (RHEL-96871) - Fix CVE-2025-47268 iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping (RHEL-94334) - ping: Fix ping6 binding to VRF and address (RHEL-57734) - arping: Fix 1s delay on exit for unsolicited arpings (RHEL-34110) - arping: exit 0 if running in deadline mode and we see replies (RHEL-27718) - ping: Print reply with wrong source with warning & some follow-up fixes (RHEL-12789, RHEL-13480) - ping: Fix socket error reporting (RHEL-4608) - Rebase to upstream commit (8e8945e509) - Rebase to upstream commit (d913f60d84) - Rebase to upstream commit (be5e3b8db2) - Release 1.9.4-2 - Rebase to upstream commit (b4b6f194da) - Rebase to upstream commit (f2c8309a41) - Open-iSCSI upstream 2.1.11 - rebase to upstream 2.1.9+ with iscsiuio 0.7.8.8 - new meson build system, sync with fedora packaging - fix CVE-2026-44943: path traversal via IQN names in discovery - fix CVE-2026-44944: iscsiuio socket credential verification bypass - fix CVE-2026-44943: path traversal via IQN names in discovery - fix CVE-2026-44944: iscsiuio socket credential verification bypass - fix regression in fw and static node records - Open-iSCSI upstream 2.1.11 - Open-iSCSI upstream 2.1.11 - rebase to upstream 2.1.9+ with iscsiuio 0.7.8.8 - new meson build system, sync with fedora packaging - fix CVE-2026-44943: path traversal via IQN names in discovery - fix CVE-2026-44944: iscsiuio socket credential verification bypass - fix CVE-2026-44943: path traversal via IQN names in discovery - fix CVE-2026-44944: iscsiuio socket credential verification bypass - fix regression in fw and static node records - Open-iSCSI upstream 2.1.11 - #1934951 remove DSA/SHA-1 based authentication support - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - update to 0.101 - bz#1958038 disabled Werror, which fixes the build with OpenSSL 3 while still using deprecated functions - setup new upstream tests as gating - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - rebase to upstream v0.100 + patches from git - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix CVE-2026-55995: prevent double-free in attrs.c error paths - #1934951 remove DSA/SHA-1 based authentication support - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - update to 0.101 - bz#1958038 disabled Werror, which fixes the build with OpenSSL 3 while still using deprecated functions - setup new upstream tests as gating - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - rebase to upstream v0.100 + patches from git - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix CVE-2026-55995: prevent double-free in attrs.c error paths - Update to 6.17 from upstream Resolves: RHEL-127107 - Update to 6.9 from upstream Resolves: RHEL-37546 - Update to 6.7 from upstream Resolves: RHEL-22657 - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Fix placement of several iwlwifi files in iwl*-firmware - Correct changelog dates Resolves: RHEL-128087 - Fix duplicate iwlwifi files in iwl*-firmware and linux-firmware packages Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Fix placement of several iwlwifi files in iwl*-firmware - Correct changelog dates Resolves: RHEL-128087 - Fix duplicate iwlwifi files in iwl*-firmware and linux-firmware packages Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Fix placement of several iwlwifi files in iwl*-firmware - Correct changelog dates Resolves: RHEL-128087 - Fix duplicate iwlwifi files in iwl*-firmware and linux-firmware packages Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Fix placement of several iwlwifi files in iwl*-firmware - Correct changelog dates Resolves: RHEL-128087 - Fix duplicate iwlwifi files in iwl*-firmware and linux-firmware packages Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Fix placement of several iwlwifi files in iwl*-firmware - Correct changelog dates Resolves: RHEL-128087 - Fix duplicate iwlwifi files in iwl*-firmware and linux-firmware packages Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Fix placement of several iwlwifi files in iwl*-firmware - Correct changelog dates Resolves: RHEL-128087 - Fix duplicate iwlwifi files in iwl*-firmware and linux-firmware packages Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Fix placement of several iwlwifi files in iwl*-firmware - Correct changelog dates Resolves: RHEL-128087 - Fix duplicate iwlwifi files in iwl*-firmware and linux-firmware packages Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Fix placement of several iwlwifi files in iwl*-firmware - Correct changelog dates Resolves: RHEL-128087 - Fix duplicate iwlwifi files in iwl*-firmware and linux-firmware packages Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Fix placement of several iwlwifi files in iwl*-firmware - Correct changelog dates Resolves: RHEL-128087 - Fix duplicate iwlwifi files in iwl*-firmware and linux-firmware packages Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Fix placement of several iwlwifi files in iwl*-firmware - Correct changelog dates Resolves: RHEL-128087 - Fix duplicate iwlwifi files in iwl*-firmware and linux-firmware packages Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Fix placement of several iwlwifi files in iwl*-firmware - Correct changelog dates Resolves: RHEL-128087 - Fix duplicate iwlwifi files in iwl*-firmware and linux-firmware packages Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Fix placement of several iwlwifi files in iwl*-firmware - Correct changelog dates Resolves: RHEL-128087 - Fix duplicate iwlwifi files in iwl*-firmware and linux-firmware packages Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Fix placement of several iwlwifi files in iwl*-firmware - Correct changelog dates Resolves: RHEL-128087 - Fix duplicate iwlwifi files in iwl*-firmware and linux-firmware packages Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Rebuilt for gating testing - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Rebase to upstream release v61.0 - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - bump release to rebuild in sidetag - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - bump release to rebuild in sidetag - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Rebase to upstream release v60.0 - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Fix pyverbs tests - Resolves: RHEL-107929, RHEL-107930 - Rebase to upstream release v57.0 - Resolves: RHEL-76570, RHEL-45644, RHEL-72077, RHEL-68506, RHEL-94449 - Fix data corruption in bnxt_re - Resolves: RHEL-89179 - Rebase to upstream release v54.0 - Resolves: RHEL-52886, RHEL-54647, RHEL-51876 - Rebase to upstream release v51.0 - Resolves: RHEL-24473, RHEL-23180 - Rebase to 2.14 Related: rhbz#2001066 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 2.13.1 (#1831402) - Fix docs build failures with Sphinx 3 (#1823532) - Use make macros: https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to the upstream v3.6.0 @ 11829386 (RHEL-64947) - Update to the upstream v3.5.0 @ b178ef6b (RHEL-30957) - Use proper SPDX license identifiers - Update to the upstream v3.4.1 @ 7bf9f85d (bz 2140043) - Fix a stack corruption on s390x - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing hash collisions - Resolves: RHEL-168185 - Fix CVE-2026-39979 out-of-bounds read in jv_parse_sized() - Resolves: RHEL-168202 - Fix CVE-2025-48060 - Resolves: RHEL-92993 - Fix CVE-2024-23337 - Resolves: RHEL-92975 - Fix SAST findings in jq 1.6 - Resolves: RHEL-28653 - Start providing versioned symbols - Resolves: rhbz#2001067 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use new cmake macros - Build using Ninja instead of Make - Add a patch to move Doxyfile into doc subdir - Remove pre-built html documentation - Update Doxyfile during %prep - Add a patch to apply some optimizations to arraylist - Hardlink the files in %_pkgdocdir - Run the testssuite with valgrind on %valgrind_arches - Add a patch to fix a test - Add a patch to fix generation of user-documentation - Add upstream patch fixing usage of errno in json_parse_uint64() - Add a patch to backport fixes applied on upstream master branch - Re-enable RDRAND as json-c can detect broken implementations in CPUs now - Disable -Werror during build - Update to 1.6.6 - Update to 1.6.4 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 1.6.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.6.0 - Update to 1.5.2 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Add vlock option to issue prompt before invokation of pam stack Resolves: RHEL-57034 - Initialize variable to avoid possible uninitialized use Resolves: RHEL-31795 - Require kbd-legacy in main kbd package again Resolves: #2139165 - Fix CVE-2026-72693: openvt -u process matching made more conservative Resolves: RHEL-235988 - Add vlock option to issue prompt before invokation of pam stack Resolves: RHEL-57034 - Add vlock option to issue prompt before invokation of pam stack Resolves: RHEL-57034 - Initialize variable to avoid possible uninitialized use Resolves: RHEL-31795 - Require kbd-legacy in main kbd package again Resolves: #2139165 - Fix CVE-2026-72693: openvt -u process matching made more conservative Resolves: RHEL-235988 - Add vlock option to issue prompt before invokation of pam stack Resolves: RHEL-57034 - Add vlock option to issue prompt before invokation of pam stack Resolves: RHEL-57034 - Initialize variable to avoid possible uninitialized use Resolves: RHEL-31795 - Require kbd-legacy in main kbd package again Resolves: #2139165 - Fix CVE-2026-72693: openvt -u process matching made more conservative Resolves: RHEL-235988 - Add vlock option to issue prompt before invokation of pam stack Resolves: RHEL-57034 - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Fix a data race in multi-threading mode (--num-threads=N) - kexec-kdump-howto.txt: update paragraphs related to disable_cpu_apicid - sysconfig: use initramfs_options to reduce memory usage - kdump-lib-initramfs: rewrite kdump_get_conf_val - kdump-lib-initramfs: Fix performance regression in kdump_get_conf_val - powerpc: Set nr_cpus=16 for kdump kernel - powerpc: consider CPU count while calculating crashkernel value - Use all available CPUs to collect dump - update 98-kexec rules for crash hotplug - Allow "sudo kdumpctl" for LUKS dump target - Restore SELinux label of crypttab file - Allow kdump.service to access LUKS volume keys - Wait for LUKS configfs API to be ready - Change LUKS volume key prefix to kdump-cryptsetup:vk- - Remove unused LUKS volume keys from keyring - Limit LUKS support to x86_64 - Add kdumpctl setup-crypttab subcommand - Return LUKS devices in the form of UUIDs directly - Fix SC2181 issues in kdump-udev-throttler - LUKS: make /usr writable - Address CPU/memory hot plugging for kdump LUKS support - shfmt kdump-udev-throttler - Use cryptsetup --link-vk-to-keyring to save volume keys - Support dumping to a LUKS-encrypted target - Add a helper function to get uuid by MAJ:MIN - kdumpctl: deprecate --reboot for reset-creashkernel - sysconfig: disable kfence in kdump kernel - Support dumping to NVMe/TCP configured using NVMe Boot Firmware Table - kdumpctl: check and generate /etc/vconsole.conf - kdump-lib.sh: Reserve crashkernel by default for systems with 1G-2G memory - Update to upstream version 1.6.3 Related: rhbz#2119105 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.6.1 - Spec cleanups - Update to upstream version 1.6.3 Related: rhbz#2119105 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.6.1 - Spec cleanups - check weak-updates directory exists before using it - Resolves: RHEL-106279 - Fix issues discovered by static analysis - Resolves: RHEL-34073 - Rebuilt for latest kernel. - Resolves: RHEL-163930 - Rebuilt for latest kernel. - Resolves: RHEL-112497 - Remove us_to_ktime definition to resolve kernel conflicts. - Resolves: RHEL-146745 - Rebuilt for latest kernel. - Resolves: RHEL-112497 - Replace from_timer with timer_container_of - Resolves: RHEL-140206 - Rebuilt for latest kernel. - Resolves: RHEL-112497 - Rebuilt for latest kernel. - Resolves: RHEL-112497 - TEMPORARY FIX to correct build failures regarding from_timer error - Resolves: RHEL-112497 - Rebuilt for latest kernel. - Resolves: RHEL-112497 - Rebuilt for latest kernel. - Resolves: RHEL-112497 - check weak-updates directory exists before using it - Resolves: RHEL-106279 - Fix issues discovered by static analysis - Resolves: RHEL-34073 - Add 0208-libmpathpersist-fix-register-retry-status-checking.patch - Add 0209-multipathd-remember-number-of-registered-keys-when-i.patch - Add 0210-libmpathpersist-fix-code-for-skipping-multipathd-pat.patch * Fixes RHEL-148462 ("Improve multipathd's handling of updating persistent reservations on restored paths. [rhel-9]") - Resolves: RHEL-148462 - Add 0206-libmultipath-add-purge_disconnected-configuration-op.patch - Add 0207-multipathd-implement-purge-functionality-for-disconn.patch * Fixes RHEL-141291 ("Add purge_disconnected support to multipathd [rhel-9]") - Resolves: RHEL-141291 - Add 0198-multipathd-print-path-offline-message-even-without-a.patch * Fixes RHEL-133814 ("log_checker_err is not printing messages repeatedly for failed path [rhel-9]") - Add 0199-libmultipath-improve-cleanup-of-uevent-queues-on-exi.patch - Add 0200-uevent_dispatch-use-while-in-wait-loop.patch - Add 0201-libmultipath-uevent_dispatch-process-uevents-one-by-.patch - Add 0202-libmultipath-uevent_listen-don-t-delay-uevents.patch - Add 0203-libmultipath-uevent-use-struct-to-pass-parameters-ar.patch - Add 0204-libmultipath-is_uevent_busy-check-servicing_uev-unde.patch - Add 0205-multipathd-make-multipathd-show-status-busy-checker-.patch * Fixes RHEL-135904 (VM reboot in RHOSP environment fails with error "Could not open '/dev/dm-95': No such file or directory") - Resolves: RHEL-133814 - Resolves: RHEL-135904 - Add 0197-multipath-tools-update-NFINIDAT-InfiniBox-config-in-.patch * Fixes RHEL-128396 ("Update the multipath.conf stanza for Infinidat storage [rhel-9]") - Resolves: RHEL-128396 - Add 0195-multipathd-Fix-race-while-registering-PR-key.patch - Add 0196-mpathpersist-Fix-REPORT-CAPABILITIES-output.patch * Fixes RHEL-118515 ("There are many bugs in multipath's persistent reservation handling") - Resolves: RHEL-118515 - Add 0150-libmpathpersist-retry-commands-on-other-paths-in-mpa.patch - Add 0151-libmpathpersist-check-released-key-against-the-reser.patch - Add 0152-multipathd-remove-thread-from-mpath_pr_event_handle.patch - Add 0153-libmpathpersist-remove-uneeded-wrapper-function.patch - Add 0154-libmpathpersist-reduce-log-level-for-persistent-rese.patch - Add 0155-libmpathpersist-remove-pointless-update_map_pr-ret-v.patch - Add 0156-multipathd-use-update_map_pr-in-mpath_pr_event_handl.patch - Add 0157-libmpathpersist-limit-changing-prflag-in-update_map_.patch - Add 0158-multipathd-Don-t-call-update_map_pr-unnecessarily.patch - Add 0159-libmpathpersist-remove-useless-function-send_prout_a.patch - Add 0160-libmpathpersist-fix-memory-leak-in-mpath_prout_rel.patch - Add 0161-limpathpersist-redesign-failed-release-workaround.patch - Add 0162-libmpathpersist-fail-the-release-if-all-threads-fail.patch - Add 0163-limpathpersist-Handle-changing-key-corner-case.patch - Add 0164-libmpathpersist-fix-command-keyword-ordering.patch - Add 0165-libmpathpersist-use-conf-timeout-for-updating-persis.patch - Add 0166-libmapthpersist-Handle-REGISTER-AND-IGNORE-changing-.patch - Add 0167-libmultipath-rename-prflag_value-enums.patch - Add 0168-libmpathpersist-use-a-switch-statement-for-prout-com.patch - Add 0169-libmpathpersist-Add-safety-check-for-preempting-on-k.patch - Add 0170-limpathpersist-remove-update_map_pr-code-for-NULL-pp.patch - Add 0171-libmpathpersist-move-update_map_pr-to-multipathd.patch - Add 0172-multipathd-clean-up-update_map_pr-and-mpath_pr_event.patch - Add 0173-libmpathpersist-clean-up-duplicate-function-declarat.patch - Add 0174-multipathd-wrap-setting-and-unsetting-prflag.patch - Add 0175-multipathd-unregister-PR-key-when-path-is-restored-i.patch - Add 0176-libmpathpersist-Fix-up-reservation_key-checking.patch - Add 0177-libmpathpersist-change-how-reservation-conflicts-are.patch - Add 0178-libmpathpersist-Clear-prkey-in-multipathd-before-unr.patch - Add 0179-libmpathpersist-only-clear-the-key-if-we-are-using-t.patch - Add 0180-libmpathpersist-Restore-old-reservation-key-on-failu.patch - Add 0181-libmpatpersist-update-reservation-key-before-checkin.patch - Add 0182-libmpathpersist-retry-on-conflicts-in-mpath_prout_co.patch - Add 0183-libmpathpersist-Don-t-always-fail-registrations-for-.patch - Add 0184-libmpathpersist-Don-t-try-release-workaround-for-inv.patch - Add 0185-libmpathpersist-Don-t-fail-RESERVE-commands-unnecess.patch - Add 0186-libmpathpersist-reregister-keys-when-self-preempting.patch - Add 0187-libmpathpersist-handle-updating-key-race-condition.patch - Add 0188-libmpathpersist-handle-preempting-all-registrants-re.patch - Add 0189-libmpathpersist-Fix-REGISTER-AND-IGNORE-while-holdin.patch - Add 0190-libmpathpersist-Handle-RESERVE-with-reservation-held.patch - Add 0191-libmpathpersist-use-check_holding_reservation-in-mpa.patch - Add 0192-libmpathpersist-Fix-unregistering-while-holding-the-.patch - Add 0193-libmpathpersist-Fix-race-between-restoring-a-path-an.patch - Add 0194-multipathd-Fix-tracking-of-old-PR-key.patch * Fixes RHEL-118515 ("There are many bugs in multipath's persistent reservation handling") - Resolves: RHEL-118515 - Add 0145-multipath-tools-add-DellEMC-ME4-PowerVault-ME4-to-ha.patch - Add 0146-multipath-tools-add-HPE-as-vendor-for-OPEN-XP8-array.patch - Add 0147-multipath-tools-add-HP-HSVX740-to-hwtable.patch - Add 0148-multipath-tools-add-DellEMC-ME5-PowerVault-ME5-to-ha.patch - Add 0149-multipath-tools-add-HPE-MSA-Gen7-2070-2072-to-hwtabl.patch * Fixes RHEL-103109 ("Update multipath builtin config to add new device defaults") - Resolves: RHEL-103109 - Add 0142-multipathd-monitor-new-multipath-dev-even-if-we-can-.patch - Add 0143-libmultipath-add-helper-function-check_path_wwid_cha.patch - Add 0144-multipathd-re-add-paths-skipped-because-they-were-of.patch * Fixes RHEL-82534 ("multipathd does not monitor multipath devices created externally while there are offline paths.") - Resolves: RHEL-82534 - Add 0140-multipath-clean-up-find_multipaths-value-names.patch - Add 0141-multipathd-Add-multipathd-man-page-section-about-soc.patch * Fixes RHEL-82307 ("There is no man page for RFE: Enable multipathd to communicate with a process in another network namespace") - Fix multipath_conf_syntax OSCI test. - Resolves: RHEL-82307 - Add 0128-multipath-tools-move-DEFAULT_SOCKET-definition-into-.patch - Add 0129-multipath-tools-add-helper-mpath_fill_sockaddr__.patch - Add 0130-libmpathutil-add-support-for-Unix-pathname-sockets.patch - Add 0131-libmpathutil-move-systemd_listen_fds-support-into-mu.patch - Add 0132-multipathd-move-uxsock_trigger-to-uxlsnr.c.patch - Add 0133-multipathd-uxlsnr-use-symbolic-values-for-pollfd-ind.patch - Add 0134-multipathd-make-uxsock_listen-take-a-pointer-to-fd.patch - Add 0135-multipathd-allow-receiving-two-socket-fds-from-syste.patch - Add 0136-multipathd-listen-on-pathname-and-abstract-socket-by.patch - Add 0137-libmpathcmd-try-both-abstract-and-pathname-sockets.patch - Add 0138-libmpathcmd-honor-MULTIPATH_SOCKET_NAME-environment-.patch - Add 0139-multipathd-honor-MULTIPATH_SOCKET_NAME-environment-v.patch * Fixes RHEL-78758 ("RFE: Enable multipathd to communicate with a process in another network namespace") - Resolves: RHEL-78758 - Rebase kpatch with upstream to v0.9.10 (RHEL-113130) - Provide a list of CVEs currently patched using live patches (RHEL-103845) - Rebase kpatch DNF plugin with upstream to 0.5 (RHEL-77113) - Rebase kpatch with upstream to v0.9.10 (RHEL-113130) - Provide a list of CVEs currently patched using live patches (RHEL-103845) - Rebase kpatch DNF plugin with upstream to 0.5 (RHEL-77113) - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356) Resolves: RHEL-171590 RHEL-171596 - krad: packet ID fetched from uninitialized variable Resolves: RHEL-145355 - Create sub-package for xrealmauthz KDC plugin Resolves: RHEL-67468 - Improving kerberos ulog resize efficiency Resolves: RHEL-145359 - Do not block HMAC-MD4/5 in FIPS mode Resolves: RHEL-88704 - Don't issue RC4 session keys by default (CVE-2025-3576) Resolves: RHEL-88048 - Add PKINIT paChecksum2 from MS-PKCA v20230920 Resolves: RHEL-82647 - Add dedicated tests sub-package - Prevent overflow when calculating ulog block size (CVE-2025-24528) Resolves: RHEL-76759 - Support PKCS11 EC client certs in PKINIT Resolves: RHEL-74374 - kdb5_util: fix DB entry flags on modification Resolves: RHEL-56059 - Add ECDH support for PKINIT (RFC5349) Resolves: RHEL-4902 - libkrad: implement support for Message-Authenticator (CVE-2024-3596) Resolves: RHEL-55423 - Fix various issues detected by static analysis Resolves: RHEL-58216 - Remove RSA protocol for PKINIT Resolves: RHEL-15323 - CVE-2024-37370 CVE-2024-37371 Fix vulnerabilities in GSS message token handling Resolves: RHEL-45402 RHEL-45392 - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356) Resolves: RHEL-171590 RHEL-171596 - krad: packet ID fetched from uninitialized variable Resolves: RHEL-145355 - Create sub-package for xrealmauthz KDC plugin Resolves: RHEL-67468 - Improving kerberos ulog resize efficiency Resolves: RHEL-145359 - Do not block HMAC-MD4/5 in FIPS mode Resolves: RHEL-88704 - Don't issue RC4 session keys by default (CVE-2025-3576) Resolves: RHEL-88048 - Add PKINIT paChecksum2 from MS-PKCA v20230920 Resolves: RHEL-82647 - Add dedicated tests sub-package - Prevent overflow when calculating ulog block size (CVE-2025-24528) Resolves: RHEL-76759 - Support PKCS11 EC client certs in PKINIT Resolves: RHEL-74374 - kdb5_util: fix DB entry flags on modification Resolves: RHEL-56059 - Add ECDH support for PKINIT (RFC5349) Resolves: RHEL-4902 - libkrad: implement support for Message-Authenticator (CVE-2024-3596) Resolves: RHEL-55423 - Fix various issues detected by static analysis Resolves: RHEL-58216 - Remove RSA protocol for PKINIT Resolves: RHEL-15323 - CVE-2024-37370 CVE-2024-37371 Fix vulnerabilities in GSS message token handling Resolves: RHEL-45402 RHEL-45392 - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356) Resolves: RHEL-171590 RHEL-171596 - krad: packet ID fetched from uninitialized variable Resolves: RHEL-145355 - Create sub-package for xrealmauthz KDC plugin Resolves: RHEL-67468 - Improving kerberos ulog resize efficiency Resolves: RHEL-145359 - Do not block HMAC-MD4/5 in FIPS mode Resolves: RHEL-88704 - Don't issue RC4 session keys by default (CVE-2025-3576) Resolves: RHEL-88048 - Add PKINIT paChecksum2 from MS-PKCA v20230920 Resolves: RHEL-82647 - Add dedicated tests sub-package - Prevent overflow when calculating ulog block size (CVE-2025-24528) Resolves: RHEL-76759 - Support PKCS11 EC client certs in PKINIT Resolves: RHEL-74374 - kdb5_util: fix DB entry flags on modification Resolves: RHEL-56059 - Add ECDH support for PKINIT (RFC5349) Resolves: RHEL-4902 - libkrad: implement support for Message-Authenticator (CVE-2024-3596) Resolves: RHEL-55423 - Fix various issues detected by static analysis Resolves: RHEL-58216 - Remove RSA protocol for PKINIT Resolves: RHEL-15323 - CVE-2024-37370 CVE-2024-37371 Fix vulnerabilities in GSS message token handling Resolves: RHEL-45402 RHEL-45392 - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356) Resolves: RHEL-171590 RHEL-171596 - krad: packet ID fetched from uninitialized variable Resolves: RHEL-145355 - Create sub-package for xrealmauthz KDC plugin Resolves: RHEL-67468 - Improving kerberos ulog resize efficiency Resolves: RHEL-145359 - Do not block HMAC-MD4/5 in FIPS mode Resolves: RHEL-88704 - Don't issue RC4 session keys by default (CVE-2025-3576) Resolves: RHEL-88048 - Add PKINIT paChecksum2 from MS-PKCA v20230920 Resolves: RHEL-82647 - Add dedicated tests sub-package - Prevent overflow when calculating ulog block size (CVE-2025-24528) Resolves: RHEL-76759 - Support PKCS11 EC client certs in PKINIT Resolves: RHEL-74374 - kdb5_util: fix DB entry flags on modification Resolves: RHEL-56059 - Add ECDH support for PKINIT (RFC5349) Resolves: RHEL-4902 - libkrad: implement support for Message-Authenticator (CVE-2024-3596) Resolves: RHEL-55423 - Fix various issues detected by static analysis Resolves: RHEL-58216 - Remove RSA protocol for PKINIT Resolves: RHEL-15323 - CVE-2024-37370 CVE-2024-37371 Fix vulnerabilities in GSS message token handling Resolves: RHEL-45402 RHEL-45392 - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356) Resolves: RHEL-171590 RHEL-171596 - krad: packet ID fetched from uninitialized variable Resolves: RHEL-145355 - Create sub-package for xrealmauthz KDC plugin Resolves: RHEL-67468 - Improving kerberos ulog resize efficiency Resolves: RHEL-145359 - Do not block HMAC-MD4/5 in FIPS mode Resolves: RHEL-88704 - Don't issue RC4 session keys by default (CVE-2025-3576) Resolves: RHEL-88048 - Add PKINIT paChecksum2 from MS-PKCA v20230920 Resolves: RHEL-82647 - Add dedicated tests sub-package - Prevent overflow when calculating ulog block size (CVE-2025-24528) Resolves: RHEL-76759 - Support PKCS11 EC client certs in PKINIT Resolves: RHEL-74374 - kdb5_util: fix DB entry flags on modification Resolves: RHEL-56059 - Add ECDH support for PKINIT (RFC5349) Resolves: RHEL-4902 - libkrad: implement support for Message-Authenticator (CVE-2024-3596) Resolves: RHEL-55423 - Fix various issues detected by static analysis Resolves: RHEL-58216 - Remove RSA protocol for PKINIT Resolves: RHEL-15323 - CVE-2024-37370 CVE-2024-37371 Fix vulnerabilities in GSS message token handling Resolves: RHEL-45402 RHEL-45392 - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356) Resolves: RHEL-171590 RHEL-171596 - krad: packet ID fetched from uninitialized variable Resolves: RHEL-145355 - Create sub-package for xrealmauthz KDC plugin Resolves: RHEL-67468 - Improving kerberos ulog resize efficiency Resolves: RHEL-145359 - Do not block HMAC-MD4/5 in FIPS mode Resolves: RHEL-88704 - Don't issue RC4 session keys by default (CVE-2025-3576) Resolves: RHEL-88048 - Add PKINIT paChecksum2 from MS-PKCA v20230920 Resolves: RHEL-82647 - Add dedicated tests sub-package - Prevent overflow when calculating ulog block size (CVE-2025-24528) Resolves: RHEL-76759 - Support PKCS11 EC client certs in PKINIT Resolves: RHEL-74374 - kdb5_util: fix DB entry flags on modification Resolves: RHEL-56059 - Add ECDH support for PKINIT (RFC5349) Resolves: RHEL-4902 - libkrad: implement support for Message-Authenticator (CVE-2024-3596) Resolves: RHEL-55423 - Fix various issues detected by static analysis Resolves: RHEL-58216 - Remove RSA protocol for PKINIT Resolves: RHEL-15323 - CVE-2024-37370 CVE-2024-37371 Fix vulnerabilities in GSS message token handling Resolves: RHEL-45402 RHEL-45392 - tlshd: Pass ETIMEDOUT from gnutls to kernel - Bump release to satisfy the errata automation - tlshd: link .nvme default keyring into the session (RHEL-71505) - Release ktls-utils 0.11 (RHEL-39442) - Initial package - Upstream contributions by: - Chuck Lever <chuck.lever@oracle.com> - Hannes Reinecke <hare@suse.de> - Jeff Layton <jlayton@kernel.org> - Benjamin Coddington <bcodding@redhat.com> - David Härdeman <david@hardeman.nu> - Tigran Mkrtchyan <tigran.mkrtchyan@desy.de> - Moritz "WanzenBug" Wanzenböck <moritz.wanzenboeck@linbit.com> - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - Bump release (RHEL-95751) - Fix string2ibpi function (RHEL-95751) - update to 1.1.0 - update to 1.0.0 - package shared ledmon library by Tony Asleson - Bump release (RHEL-95751) - Fix string2ibpi function (RHEL-95751) - update to 1.1.0 - update to 1.0.0 - package shared ledmon library by Tony Asleson - fix hyperlink underline continuing on next line (RHEL-31219) - fix static analysis findings (RHEL-51178) - fix less with LESSOPEN allowing command injection (CVE-2024-32487) (RHEL-32739) - Fix CVE-2022-48624 - Resolves: RHEL-26265 - preserve failed setfacl return code (RHEL-11833) - rebase to 2.4.0 to fix the following CVEs: - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions (RHEL-186111) - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl (RHEL-186216) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable LTO - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Related: CVE-2026-14164 - Resolves: CVE-2026-14164 - Resolves: CVE-2026-4424 - Resolves: CVE-2026-5121 - Release bump - Resolves: CVE-2026-4111 - Resolves: CVE-2025-5914 - Resolves: CVE-2025-25724 - Resolves: CVE-2026-4424 - Resolves: CVE-2026-5121 - Release bump - Resolves: CVE-2026-4111 - Resolves: CVE-2025-5914 - Resolves: CVE-2025-25724 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - New upstream release (#1941663) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream release (#1891067) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - add includedir to pkg-config --cflags (#1742986) - Debrand for AlmaLinux - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding branches and calls to gcov output, but not conditions (RHEL-105416). - Fix testsuite failures when run with -fstack-protector* (PR testsuite/70230, RHEL-116477) - Add cross compilers for ppc64le and s390x for non-production uses (RHEL-94764) - Adjust glibc32 build dependency (RHEL-105072) - Exception handling performance improvements (RHEL-105072) - libgcc: Use _dl_find_object to find DWARF data in unwinder - libgcc: Use lock-free data structures for run-time unwinder registration - Pin modification time for python files to SOURCE_DATE_EPOCH (RHEL-100148). - Sync libstdc++ pretty printers to latest GTS (RHEL-81975) - Fix folding of BIT_NOT_EXPR for POLY_INT_CST (PR 118976, RHEL-90239) - rs6000: Rework ELFv2 support for -fpatchable-function-entry (PR target/99888, RHEL-75806) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - new upstream release - new upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - add BR for perl(FileHandle) needed by %check - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - rebase to 2.6.0 to fix the following CVEs: - CVE-2026-54371 - Symlink Traversal Privilege Escalation via getfattr (RHEL-186121) - Resolves: rhbz#2048667 - Request to add libdhash-devel package into CRB - Resolves: rhbz#1938708 - review of important potential issues detected by static analyzers in ding-libs-0.6.1-47.el9 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: rhbz#1962772 - Add gating tests for ding-libs in RHEL 9 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - fix RHEL-132706 - use sysusers.d for uuidd - fix RHEL-133956 - login-utils: fix setpwnam() buffer use [CVE-2025-14104] - fix RHEL-123527 - mount: improve --all documentation - fix RHEL-123531 - libblkid: use snprintf() instead of sprintf() - fix RHEL-123536 - libfdisk: (dos) fix off-by-one in maximum last sector calculation - fix RHEL-113638 - lscpu: update ARM identifiers - fix RHEL-108386 - libblkid: (jmicron_raid) backport checksum verification - fix RHEL-56354 - lib/timeutils: parse_timestamp: fix second parsing - fix RHEL-56983 - sulogin: fix POSIX locale use - fix RHEL-25559 - more: make sure we have data on stderr - fix RHEL-34165 - lsipc: fix semaphore USED counter - fix RHEL-25265 - libblkid: Check offset in LUKS2 header - fix RHEL-25559 - more: fix poll() use - lscpu: another tests update (RHEL-12783) - lscpu: update tests, follow max freq for scaling (RHEL-12783) - fix RHEL-16048 - uninitialized memory in SCM_CREDENTIALS in logger(1) - fix RHEL-21257 - logger sending process start time not current time with log messages - fix RHEL-16071 - issues in libblkid - fix RHEL-12783 - lscpu -e doesn't show the current real frequency value - fix RHEL-14612 - Userspace mount options are not preserved for NFS - Update to BPF 6.17 stable backport (RHEL-118560) - Update to BPF 6.14 stable backport (RHEL-99685) - Update to BPF 6.12 rebase (RHEL-30778) - Update to BPF 6.8 rebase (RHEL-30776) - Fix bug in bpf_xdp_query causing stack corruption (RHEL-26037) - Update to BPF 6.6 rebase (RHEL-10695) - CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder - Resolves: RHEL-290294 - Accept output_buffer_limit as an alias for max_output_length in Decompressor.process() for forward compatibility with upstream 1.2.0 - Resolves: RHEL-221150 - Resolves: RHEL-133995 Rebuild for CVE-2025-6176 Brotli decompression bomb DoS in scrapy - Resolves: RHEL-133995 CVE-2025-6176 Brotli decompression bomb DoS in scrapy - Accept output_buffer_limit as an alias for max_output_length in Decompressor.process() for forward compatibility with upstream 1.2.0 - Resolves: RHEL-221150 - Resolves: RHEL-133995 Rebuild for CVE-2025-6176 Brotli decompression bomb DoS in scrapy - Resolves: RHEL-133995 CVE-2025-6176 Brotli decompression bomb DoS in scrapy - Check BitMask(n) n value for kBrotliBitMask[n] bounds - Resolves: RHEL-133995 Rebuild for CVE-2025-6176 Brotli decompression bomb DoS in scrapy - Resolves: RHEL-133995 CVE-2025-6176 Brotli decompression bomb DoS in scrapy - Check BitMask(n) n value for kBrotliBitMask[n] bounds - Fix TOCTOU race condition in cap_set_file() (CVE-2026-4878) Resolves: RHEL-169312 - Fix typos in the cap_from_text.3 man page Resolves: RHEL-1838 - Update apply-disable patch (#2045857) Resolves: rhbz#2045857 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Adjust syslog warning for bad use of capng_apply - Add syslog warning for bad use of capng_apply - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream bugfix release - Add temporary patch disabling bounding set error codes - New upstream bugfix release - New upstream feature release - Update apply-disable patch (#2045857) Resolves: rhbz#2045857 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Adjust syslog warning for bad use of capng_apply - Add syslog warning for bad use of capng_apply - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream bugfix release - Add temporary patch disabling bounding set error codes - New upstream bugfix release - New upstream feature release - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Avoid hardcoding man page extension - update to 0.7.0 Resolves: rhbz#1813738 Resolves: rhbz#1863978 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fix FTBFS, add version for soname, minor cleanups - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Resolves: rhbz#2048667 - Request to add libdhash-devel package into CRB - Resolves: rhbz#1938708 - review of important potential issues detected by static analyzers in ding-libs-0.6.1-47.el9 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: rhbz#1962772 - Add gating tests for ding-libs in RHEL 9 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - ext2fs: make sure we have at least EXT2_FIRST_INO + 1 inodes - Fix: e2fsprogs: online resize fails - Related: RHEL-76095 - Bump release to perform build verification for gating changes - Related: RHEL-71250 - rebuild to incorporate libss-devel package - Related: RHEL-19059 - Change the xattr entry hash to use an unsighed char by default - Related: RHEL-10467 - Update to 0.1.18 - Don't print empty requires - Remove Python 2 support - Fix issues detected by static analyzers - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update to 0.1.16 - Fix a crash when clearing COMPS_ObjRTree (RhBug:1888343) - Fix memory leaks and resource leaks - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - spec: Fix building with new cmake macros - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - openssl: fix libssh compatibility by preserving original SSL_CTX behavior (RHEL-134721) - openssl: fix libssh compatibility in crypto-policy patch (RHEL-134721) - http: fix crash in rate-limited upload (RHEL-131696) - openssl: respect system crypto policy for TLS max version (RHEL-128914) - rebuild for c9s (RHEL-125838) - cookie: don't treat the leading slash as trailing (CVE-2025-9086) Resolves: RHEL-121659 - revert several disabled tests related to openssl/valgrind (RHEL-99465) - noproxy: support proxies specified using cidr notation (RHEL-81412) - make up incomplete patch for host name wildcard checking (RHEL-5675) - eliminate use of obsolete patch syntax (RHEL-65791) - http2: make sure pause is done on HTTP (RHEL-85847) - provide common cleanup method for push headers (CVE-2024-2398) - fix missing %patch macros for Patch46 and Patch47 - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind) - tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race) - fix SSH host key mismatch on type difference (CVE-2026-9547) - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286) - openssl: fix libssh compatibility by preserving original SSL_CTX behavior (RHEL-134721) - openssl: fix libssh compatibility in crypto-policy patch (RHEL-134721) - http: fix crash in rate-limited upload (RHEL-131696) - openssl: respect system crypto policy for TLS max version (RHEL-128914) - rebuild for c9s (RHEL-125838) - cookie: don't treat the leading slash as trailing (CVE-2025-9086) Resolves: RHEL-121659 - add sasl service name to connection reuse checks (CVE-2026-8458) - detect proxy changes read from environment (CVE-2026-8927) - fix missing %patch macros for Patch46 and Patch47 - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind) - tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race) - fix SSH host key mismatch on type difference (CVE-2026-9547) - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286) - openssl: fix libssh compatibility by preserving original SSL_CTX behavior (RHEL-134721) - openssl: fix libssh compatibility in crypto-policy patch (RHEL-134721) - http: fix crash in rate-limited upload (RHEL-131696) - openssl: respect system crypto policy for TLS max version (RHEL-128914) - fix cookie injection via trailing dot super cookies (CVE-2026-8924) - fix digest auth state leak on origin or credential change (CVE-2026-11856) - add sasl service name to connection reuse checks (CVE-2026-8458) - detect proxy changes read from environment (CVE-2026-8927) - fix missing %patch macros for Patch46 and Patch47 - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind) - tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race) - fix SSH host key mismatch on type difference (CVE-2026-9547) - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286) - openssl: fix libssh compatibility by preserving original SSL_CTX behavior (RHEL-134721) - openssl: fix libssh compatibility in crypto-policy patch (RHEL-134721) - http: fix crash in rate-limited upload (RHEL-131696) - openssl: fix libssh compatibility by preserving original SSL_CTX behavior (RHEL-134721) - openssl: fix libssh compatibility in crypto-policy patch (RHEL-134721) - http: fix crash in rate-limited upload (RHEL-131696) - openssl: respect system crypto policy for TLS max version (RHEL-128914) - rebuild for c9s (RHEL-125838) - cookie: don't treat the leading slash as trailing (CVE-2025-9086) Resolves: RHEL-121659 - revert several disabled tests related to openssl/valgrind (RHEL-99465) - noproxy: support proxies specified using cidr notation (RHEL-81412) - make up incomplete patch for host name wildcard checking (RHEL-5675) - eliminate use of obsolete patch syntax (RHEL-65791) - http2: make sure pause is done on HTTP (RHEL-85847) - provide common cleanup method for push headers (CVE-2024-2398) - fix missing %patch macros for Patch46 and Patch47 - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind) - tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race) - fix SSH host key mismatch on type difference (CVE-2026-9547) - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286) - openssl: fix libssh compatibility by preserving original SSL_CTX behavior (RHEL-134721) - openssl: fix libssh compatibility in crypto-policy patch (RHEL-134721) - http: fix crash in rate-limited upload (RHEL-131696) - openssl: respect system crypto policy for TLS max version (RHEL-128914) - rebuild for c9s (RHEL-125838) - cookie: don't treat the leading slash as trailing (CVE-2025-9086) Resolves: RHEL-121659 - add sasl service name to connection reuse checks (CVE-2026-8458) - detect proxy changes read from environment (CVE-2026-8927) - fix missing %patch macros for Patch46 and Patch47 - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind) - tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race) - fix SSH host key mismatch on type difference (CVE-2026-9547) - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286) - openssl: fix libssh compatibility by preserving original SSL_CTX behavior (RHEL-134721) - openssl: fix libssh compatibility in crypto-policy patch (RHEL-134721) - http: fix crash in rate-limited upload (RHEL-131696) - openssl: respect system crypto policy for TLS max version (RHEL-128914) - fix cookie injection via trailing dot super cookies (CVE-2026-8924) - fix digest auth state leak on origin or credential change (CVE-2026-11856) - add sasl service name to connection reuse checks (CVE-2026-8458) - detect proxy changes read from environment (CVE-2026-8927) - fix missing %patch macros for Patch46 and Patch47 - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind) - tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race) - fix SSH host key mismatch on type difference (CVE-2026-9547) - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286) - openssl: fix libssh compatibility by preserving original SSL_CTX behavior (RHEL-134721) - openssl: fix libssh compatibility in crypto-policy patch (RHEL-134721) - http: fix crash in rate-limited upload (RHEL-131696) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Adress rpminspect issue - missing debuginfo for db_converter - Use a fixed path, /usr/lib64/libc.so.6 for 64-bit targets - Rebase db_converter tool to the latest version - Add db_converter into -utils subpackage - It allowes to convert BerkeleyDB database format to GDBM/LMDB format - Resolves: RHEL-35607 - Resolves: rhbz#2048667 - Request to add libdhash-devel package into CRB - Resolves: rhbz#1938708 - review of important potential issues detected by static analyzers in ding-libs-0.6.1-47.el9 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: rhbz#1962772 - Add gating tests for ding-libs in RHEL 9 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Added patch for almalinux bugtracker - Fix a crash when parsing multiple key files fails (RHEL-145618) - Mark all protected packages as user installed for all transactions (RHEL-76112) - Add `filterUnneededExtraUserinstalled` and Python version to the API - Describe all problems even when there are protected removals (RHEL-115194) - Clearer error for protected package broken dependencies - Fix comparison of RPM items in the transaction (RHEL-81779) - Introduce $releasever_major, $releasever_minor variables, shell-style variable substitution (RHEL-95006) - history DB: Add "persistence" column (RHEL-100623) - conf: Add bootc_unsafe_paths (RHEL-100622) - module: Warn if module config file is inaccessible (RHEL-62833) - Add persistence configuration option (RHEL-78024) - Do not set a default SELinux creation context if SELinux appears to be disabled (RHEL-43232) - Fix reinstalling packages which conflicts with themselves in dnf_transaction_commit() (RHEL-1454) - Fix calculating a difference between two same-version RPM transacations (RHEL-17494) - Debrand for AlmaLinux - fix: Print list of environments without --set/--list (jhnidek@redhat.com) - RHEL-126157: Update GCP to Google Cloud in log messages (crag@redhat.com) - fix: Update user-facing GCP refrences to Google Cloud (crag@redhat.com) - feat: check if --set arg is empty when the environments module is called (manuelcanorojo@gmail.com) - feat: Added more debug prints to cloud-what (jhnidek@redhat.com) - fix(test): Fix unit test of aws (jhnidek@redhat.com) - fix: Fix getting AWS IMDSv2 signature (jhnidek@redhat.com) - chore: Make new black happy again (jhnidek@redhat.com) - chore: Increased log level of messages (jhnidek@redhat.com) - fix: Use IMDSv2 for signature first (jhnidek@redhat.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Georgian) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Added translation using Weblate (Finnish) (noreply-addon- languages@weblate.org) - fix: TypeError in _get_tls_handshake_info type hinting (macano@redhat.com) - feat: added signature type log in TLS handshake (macano@redhat.com) - feat: added internal method to get tls handshake info (manuelcanorojo@gmail.com) - ci: bump actions/upload-artifact from 5 to 6 (49699333+dependabot[bot]@users.noreply.github.com) - Fix profile upload because of missing self.cp (suttner@atix.de) - Fix upload profile if rhsmcertd is not running at all (suttner@atix.de) - ci: bump actions/checkout from 5 to 6 (49699333+dependabot[bot]@users.noreply.github.com) - Translated using Weblate (Korean) (simmon@nplob.com) - ci: bump actions/upload-artifact from 4 to 5 (49699333+dependabot[bot]@users.noreply.github.com) - feat: [1.29] Added dnf4 warning about skewed clock (jhnidek@redhat.com) - fix: [1.29] Require findutils in .spec file (jhnidek@redhat.com) - ci: bump actions/checkout from 4 to 5 (49699333+dependabot[bot]@users.noreply.github.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Spanish) (fserrador@gmail.com) - Translated using Weblate (Spanish) (jsefler@redhat.com) - Translated using Weblate (Korean) (simmon@nplob.com) - fix: [1.29] Wait random time before reaching IMDS server (jhnidek@redhat.com) - feat: [1.29] Call random.seed() at begining of auto-register (jhnidek@redhat.com) - feat: [1.29] Better control over auto-reg waiting game (jhnidek@redhat.com) - fix: [1.29] Enable content during auto-registration v2 (jhnidek@redhat.com) - Translated using Weblate (Italian) (info@salvatorecocuzza.it) - Translated using Weblate (Italian) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (Italian) (info@salvatorecocuzza.it) - Translated using Weblate (Spanish) (fserrador@gmail.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Chinese (Traditional) (zh_TW)) (chzang55@gmail.com) - Translated using Weblate (Chinese (Simplified) (zh_CN)) (mhorky@redhat.com) - Translated using Weblate (Georgian) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (French) (leane.grasser@proton.me) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (Korean) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (Korean) (noreply-mt-weblate-translation- memory@weblate.org) - Update translation files (noreply@weblate.org) - fix: Handle improperly closed connections (mhorky@redhat.com) - ci: use the right distro for coverage reporting (ptoscano@redhat.com) - New extraction for translatable strings (ptoscano@redhat.com) - Translated using Weblate (Italian) (toscano.pino@tiscali.it) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (French) (leane.grasser@proton.me) - tests: fix mocking of get_terminal_width() in TestColumnize (ptoscano@redhat.com) - feat: print compliance errors & syspurpose status only in entitlement mode (ptoscano@redhat.com) - feat: print "registered" as status when using SCA (ptoscano@redhat.com) - feat: print "not registered" on status when not registered (ptoscano@redhat.com) - tests: force syspurpose tests in test_status to non-SCA (ptoscano@redhat.com) - refactor: move determination of content access mode in own method (ptoscano@redhat.com) - tests: move StubIdentity to stubs (ptoscano@redhat.com) - tests: cleanup dead/broken bits in test_status (ptoscano@redhat.com) - chore: move banner printing to its own function (ptoscano@redhat.com) - fix: Append two additional facts to the graylist (pkoprda@redhat.com) - refactor: Use class constant instead of variable graylist (pkoprda@redhat.com) - fix: Do not upload profile from DNF, when it is disabled in conf (jhnidek@redhat.com) - feat: dnf plugin - outsource uploading of profile to rhsmcertd. (jhnidek@redhat.com) - feat: Enable register with environment names and environment types (jhnidek@redhat.com) - feat: support registering specifying environments with activation keys (ryanverdile@gmail.com) - chore: Remove auto-assign CI job (mhorky@redhat.com) - feat: [1.29] Added basic configuration for Packit (jhnidek@redhat.com) - Revert "feat: Disable anonymous cloud registration temporarily" (ptoscano@redhat.com) - Revert "feat: forcefully switch automatic cloud registration to v1" (ptoscano@redhat.com) - Translated using Weblate (Chinese (Simplified) (zh_CN)) (ptoscano@redhat.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (French) (leane.grasser@proton.me) - Update translation files (noreply@weblate.org) - New extraction for translatable strings (ptoscano@redhat.com) - Translated using Weblate (Italian) (info@salvatorecocuzza.it) - Translated using Weblate (French) (leane.grasser@proton.me) - Translated using Weblate (German) (atalanttore@googlemail.com) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - [1.29] feat/cct-868: Subset of list command options marked as deprecated * Options --available, --all, --ondate, --servicelevel --no-overlap --match- install, --pool-only, --afterdate were marked as deprecated in ListCommand definition of their help string. (mgrunwal@redhat.com) - fix: Handle Retry-After headers better for 429 responses (mhorky@redhat.com) - feat: Better automatic registration logging (mhorky@redhat.com) - fix: perform autoreg waiting when performing standard autoreg (ptoscano@redhat.com) - chore: move autoreg waiting code in own function (ptoscano@redhat.com) - docs: update proxy details in man page (jvlcek@redhat.com) - feat: forcefully switch automatic cloud registration to v1 (ptoscano@redhat.com) - Update to 2.4.128-1 - Added amdgpu-slice.patch and amdgpu-fallback.patch - Update to 2.4.127 amdgpu-apu.patch: Read model name from /proc/cpuinfo for APUs - Revert upstream commit ffaa3ce144be ("2.4.122, Build Intel on all arches") libpciaccess is not available in RHEL 9 aarch64, ppc64le and s390x Resolves: https://issues.redhat.com/browse/RHEL-53869 - Update to 2.4.123 Resolves: https://issues.redhat.com/browse/RHEL-53869 - Update to 2.4.121 - Update to 2.4.120 - Fix findings from static application security testing (SAST) - Avoid double-free memory corruption. Resolves: RHEL-130877 - Fix static analyzer detected issues. Resolves: RHEL-24989 - Add libeconf-devel to a public repo. Resolves: RHEL-126957 - Avoid double-free memory corruption. Resolves: RHEL-130877 - Fix static analyzer detected issues. Resolves: RHEL-24989 - Fix removing of readline callback handler (RHEL-133732) - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - add -devel subpackage into CRB - Resolves: RHEL-38617 - Rework the patch from 2.1.12-7 to prevent ABI changes. - Related: RHEL-26128 - Patch duplicate file descriptor manipulation - Resolves: RHEL-26128 - Update to 2.1.13. - The following CVEs are fixed: - CVE-2026-63383 - CVE-2026-63384 - CVE-2026-63388 - CVE-2026-63387 - CVE-2026-63379 - CVE-2026-63381 - CVE-2026-63382 - CVE-2026-63385 - fix RHEL-132706 - use sysusers.d for uuidd - fix RHEL-133956 - login-utils: fix setpwnam() buffer use [CVE-2025-14104] - fix RHEL-123527 - mount: improve --all documentation - fix RHEL-123531 - libblkid: use snprintf() instead of sprintf() - fix RHEL-123536 - libfdisk: (dos) fix off-by-one in maximum last sector calculation - fix RHEL-113638 - lscpu: update ARM identifiers - fix RHEL-108386 - libblkid: (jmicron_raid) backport checksum verification - fix RHEL-56354 - lib/timeutils: parse_timestamp: fix second parsing - fix RHEL-56983 - sulogin: fix POSIX locale use - fix RHEL-25559 - more: make sure we have data on stderr - fix RHEL-34165 - lsipc: fix semaphore USED counter - fix RHEL-25265 - libblkid: Check offset in LUKS2 header - fix RHEL-25559 - more: fix poll() use - lscpu: another tests update (RHEL-12783) - lscpu: update tests, follow max freq for scaling (RHEL-12783) - fix RHEL-16048 - uninitialized memory in SCM_CREDENTIALS in logger(1) - fix RHEL-21257 - logger sending process start time not current time with log messages - fix RHEL-16071 - issues in libblkid - fix RHEL-12783 - lscpu -e doesn't show the current real frequency value - fix RHEL-14612 - Userspace mount options are not preserved for NFS - Use /etc/sysconfig/libffi-force-shared-memory-check-first to override selinux permissions check for shared memory access (#2152228) - Remove compat-libffi3.1 subpackage to complete SONAME transition. Related: rhbz#1891914 - Rebuilt for libffi 3.4.2 SONAME transition. Related: rhbz#1891914 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop pkgconf support for compat-libffi3.1. - Add temporary compat-libffi3.1 for library transition. - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Rebase to libffi 3.4.2. - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - rebuilt - Upgrade to 1.13 Resolves: rhbz#2122193 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - New upstream release - New upstream release - Debrand for AlmaLinux - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding branches and calls to gcov output, but not conditions (RHEL-105416). - Fix testsuite failures when run with -fstack-protector* (PR testsuite/70230, RHEL-116477) - Add cross compilers for ppc64le and s390x for non-production uses (RHEL-94764) - Adjust glibc32 build dependency (RHEL-105072) - Exception handling performance improvements (RHEL-105072) - libgcc: Use _dl_find_object to find DWARF data in unwinder - libgcc: Use lock-free data structures for run-time unwinder registration - Pin modification time for python files to SOURCE_DATE_EPOCH (RHEL-100148). - Sync libstdc++ pretty printers to latest GTS (RHEL-81975) - Fix folding of BIT_NOT_EXPR for POLY_INT_CST (PR 118976, RHEL-90239) - rs6000: Rework ELFv2 support for -fpatchable-function-entry (PR target/99888, RHEL-75806) - Fix CVE-2024-2236 (RHEL-34579) - Provide FIPS indicators for MD and HMACs - Improve PCT tests for ECDSA and always run them after key is generated - Add missing guards for FIPS status in md_sign/verify function - Provider FIPS indicators for public key operation flags - Avoid usage of invalid arguments sizes for PBKDF2 in FIPS mode - Do not allow large salt lengths with RSA-PSS padding - Disable X9.31 key generation in FIPS mode - Update the FIPS integrity checking code to upstream version - Update cipher modes FIPS indicators for AES WRAP and GCM - Disable jitter entropy generator - Fix unneeded PBKDF2 passphrase length limitation in FIPS mode - Enforce HMAC key lengths in MD API in FIPS mode - Properly enforce KDF limits in FIPS mode (#2130275) - Fix memory leak in large digest test (#2129150) - Fix function name FIPS service indicator by disabling PK encryption and decryption (#2130275) - Skip RSA encryption/decryption selftest in FIPS mode (#2130275) - Fix SHA3 digests with large inputs (#2129150) - Fix FIPS RSA PCT (#2128455) - Fix RSA FIPS Keygen that non-deterministically fails (#2130275) - Get max 32B from getrandom in FIPS mode (#2130275) - Allow signature verification with smaller RSA keys (#2083846) - Allow short salt for KDF (#2114870) - Reseed the kernel DRBG by using GRND_RANDOM (#2118695) - Address FIPS review comments around selftests (#2118695) - Disable RSA-OAEP in FIPS mode (#2118695) - Bump version to fix wrong build target. - Fix CVE-2026-41989: Denial of Service and buffer overflow via crafted ECDH ciphertext - Fix CVE-2024-2236 (RHEL-34579) - Debrand for AlmaLinux - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding branches and calls to gcov output, but not conditions (RHEL-105416). - Fix testsuite failures when run with -fstack-protector* (PR testsuite/70230, RHEL-116477) - Add cross compilers for ppc64le and s390x for non-production uses (RHEL-94764) - Adjust glibc32 build dependency (RHEL-105072) - Exception handling performance improvements (RHEL-105072) - libgcc: Use _dl_find_object to find DWARF data in unwinder - libgcc: Use lock-free data structures for run-time unwinder registration - Pin modification time for python files to SOURCE_DATE_EPOCH (RHEL-100148). - Sync libstdc++ pretty printers to latest GTS (RHEL-81975) - Fix folding of BIT_NOT_EXPR for POLY_INT_CST (PR 118976, RHEL-90239) - rs6000: Rework ELFv2 support for -fpatchable-function-entry (PR target/99888, RHEL-75806) - Debrand for AlmaLinux - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding branches and calls to gcov output, but not conditions (RHEL-105416). - Fix testsuite failures when run with -fstack-protector* (PR testsuite/70230, RHEL-116477) - Add cross compilers for ppc64le and s390x for non-production uses (RHEL-94764) - Adjust glibc32 build dependency (RHEL-105072) - Exception handling performance improvements (RHEL-105072) - libgcc: Use _dl_find_object to find DWARF data in unwinder - libgcc: Use lock-free data structures for run-time unwinder registration - Pin modification time for python files to SOURCE_DATE_EPOCH (RHEL-100148). - Sync libstdc++ pretty printers to latest GTS (RHEL-81975) - Fix folding of BIT_NOT_EXPR for POLY_INT_CST (PR 118976, RHEL-90239) - rs6000: Rework ELFv2 support for -fpatchable-function-entry (PR target/99888, RHEL-75806) - Avoid using bad function inet_addr - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Address coverity reported issues - New upstream release (#1941582) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream release (#1909749) - New upstream release (#1800640) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - new upstream release 1.37 + libgudev-237-1 - Update to 237 - Resolves: rhbz#1995044 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 + libgudev-236-1 - Update to 236 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + libgudev-234-1 - Update to 234 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Backport a patch to fix a rare multithreaded crash on device replug - Resolves: rhbz#2227760 - New upstream version - Add new API requested by fwupd - Add the GUsbEndpoint methods to the docs - Fix hotplug handling and signal emission during enumerate - Do not double-reference USB devices - Resolves: rhbz#1965885 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for gating testing - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Rebase to upstream release v61.0 - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - bump release to rebuild in sidetag - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - bump release to rebuild in sidetag - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Rebase to upstream release v60.0 - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Fix pyverbs tests - Resolves: RHEL-107929, RHEL-107930 - Rebase to upstream release v57.0 - Resolves: RHEL-76570, RHEL-45644, RHEL-72077, RHEL-68506, RHEL-94449 - Fix data corruption in bnxt_re - Resolves: RHEL-89179 - Rebase to upstream release v54.0 - Resolves: RHEL-52886, RHEL-54647, RHEL-51876 - Rebase to upstream release v51.0 - Resolves: RHEL-24473, RHEL-23180 - Rebuilt for gating testing - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Rebase to upstream release v61.0 - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - bump release to rebuild in sidetag - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - bump release to rebuild in sidetag - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Rebase to upstream release v60.0 - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Fix pyverbs tests - Resolves: RHEL-107929, RHEL-107930 - Rebase to upstream release v57.0 - Resolves: RHEL-76570, RHEL-45644, RHEL-72077, RHEL-68506, RHEL-94449 - Fix data corruption in bnxt_re - Resolves: RHEL-89179 - Rebase to upstream release v54.0 - Resolves: RHEL-52886, RHEL-54647, RHEL-51876 - Rebase to upstream release v51.0 - Resolves: RHEL-24473, RHEL-23180 - Rebuilt for gating testing - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Rebase to upstream release v61.0 - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - bump release to rebuild in sidetag - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - bump release to rebuild in sidetag - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Rebase to upstream release v60.0 - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Fix pyverbs tests - Resolves: RHEL-107929, RHEL-107930 - Rebase to upstream release v57.0 - Resolves: RHEL-76570, RHEL-45644, RHEL-72077, RHEL-68506, RHEL-94449 - Fix data corruption in bnxt_re - Resolves: RHEL-89179 - Rebase to upstream release v54.0 - Resolves: RHEL-52886, RHEL-54647, RHEL-51876 - Rebase to upstream release v51.0 - Resolves: RHEL-24473, RHEL-23180 - ICU-22973 Fix buffer overflow by using CharString Resolves: RHEL-96664 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Touch a couple autoconf related files to prevent undesired rebuilding if %configure changes one or more configure files. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Upgrade to 2.3.0 (#1764345, #1772703) - Resolves: rhbz#2048667 - Request to add libdhash-devel package into CRB - Resolves: rhbz#1938708 - review of important potential issues detected by static analyzers in ding-libs-0.6.1-47.el9 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: rhbz#1962772 - Add gating tests for ding-libs in RHEL 9 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - New upstream release - Fall back to the AliasId for validation - Fix jcat_context_verify_blob() to use self verify for checksums - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream release - Allow verifying expired certificates with an additional argument - New upstream release - Export the old JCatEngine property to preserve internal ABI - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - New upstream release - Export the JcatBlobKind and JcatBlobMethod on the result - Fix for CVE-2020-10759 - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356) Resolves: RHEL-171590 RHEL-171596 - krad: packet ID fetched from uninitialized variable Resolves: RHEL-145355 - Create sub-package for xrealmauthz KDC plugin Resolves: RHEL-67468 - Improving kerberos ulog resize efficiency Resolves: RHEL-145359 - Do not block HMAC-MD4/5 in FIPS mode Resolves: RHEL-88704 - Don't issue RC4 session keys by default (CVE-2025-3576) Resolves: RHEL-88048 - Add PKINIT paChecksum2 from MS-PKCA v20230920 Resolves: RHEL-82647 - Add dedicated tests sub-package - Prevent overflow when calculating ulog block size (CVE-2025-24528) Resolves: RHEL-76759 - Support PKCS11 EC client certs in PKINIT Resolves: RHEL-74374 - kdb5_util: fix DB entry flags on modification Resolves: RHEL-56059 - Add ECDH support for PKINIT (RFC5349) Resolves: RHEL-4902 - libkrad: implement support for Message-Authenticator (CVE-2024-3596) Resolves: RHEL-55423 - Fix various issues detected by static analysis Resolves: RHEL-58216 - Remove RSA protocol for PKINIT Resolves: RHEL-15323 - CVE-2024-37370 CVE-2024-37371 Fix vulnerabilities in GSS message token handling Resolves: RHEL-45402 RHEL-45392 - Backport fixes for kcapi-hasher target option Related: RHEL-15298 - Fix kcapi tests in FIPS mode Resolves: RHEL-2405 - Update to new upstream release 1.4.0 Resolves: RHEL-5367 - Add a patch to fix auxiliary tests in FIPS mode Resolves: RHEL-2405 - Add a patch to zeroize kcapi-hasher for FIPS 140-3 Resolves: RHEL-15112 - Add a patch to allow overriding target file in kcapi-hasher Resolves: RHEL-15298 - Remove ansi_cprng test as new kernels don't support it Resolves: RHEL-242707 - Add tag processing in AEAD decryption without ciphertext Resolves: RHEL-242667 - CVE-2026-71226: Fix memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path Resolves: RHEL-224815 - CVE-2026-71227: Fix infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return Resolves: RHEL-224976 - CVE-2026-71225: Fix IV reuse in libkcapi one-shot symmetric cipher chunking Resolves: RHEL-224704 - Backport fixes for kcapi-hasher target option Related: RHEL-15298 - Fix kcapi tests in FIPS mode Resolves: RHEL-2405 - Update to new upstream release 1.4.0 Resolves: RHEL-5367 - Add a patch to fix auxiliary tests in FIPS mode Resolves: RHEL-2405 - Add a patch to zeroize kcapi-hasher for FIPS 140-3 Resolves: RHEL-15112 - Add a patch to allow overriding target file in kcapi-hasher Resolves: RHEL-15298 - Remove ansi_cprng test as new kernels don't support it Resolves: RHEL-242707 - Add tag processing in AEAD decryption without ciphertext Resolves: RHEL-242667 - CVE-2026-71226: Fix memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path Resolves: RHEL-224815 - CVE-2026-71227: Fix infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return Resolves: RHEL-224976 - CVE-2026-71225: Fix IV reuse in libkcapi one-shot symmetric cipher chunking Resolves: RHEL-224704 - Fix SAST reports (RHEL-25067) - Fix for CVE-2022-47629 (#2161571) - Fix for CVE-2022-3515 (#2135703) - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - 2112377 - move liblockfile to BaseOS - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.32 (RHEL-101709) - Update to 1.30.0 - Update to 1.32 (RHEL-101709) - Update to 1.30.0 - libmnl: zero attribute padding - Enable accept_overflowed_buildorder in tier0 tests (bug #1984403) - 2.13.0 bump (bug #1984403) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - 2.12.1 bump (bug #1956346) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Add support for 'buildorder' to Packager documents - Fix issue with ModuleIndex when input contains only Obsoletes documents - Fix import issue when built with Python 2 support - Release 2.11.2 - Extend read_packager_[file|string]() to support overriding the module name and stream. - Release 2.11.1 - Ignore Packager documents when running ModuleIndex.update_from_*() - Add python overrides for XMD in PackagerV3 - Add python override to ignore the GType return when reading packager files - Add PackagerV3.get_mdversion() - fix RHEL-132706 - use sysusers.d for uuidd - fix RHEL-133956 - login-utils: fix setpwnam() buffer use [CVE-2025-14104] - fix RHEL-123527 - mount: improve --all documentation - fix RHEL-123531 - libblkid: use snprintf() instead of sprintf() - fix RHEL-123536 - libfdisk: (dos) fix off-by-one in maximum last sector calculation - fix RHEL-113638 - lscpu: update ARM identifiers - fix RHEL-108386 - libblkid: (jmicron_raid) backport checksum verification - fix RHEL-56354 - lib/timeutils: parse_timestamp: fix second parsing - fix RHEL-56983 - sulogin: fix POSIX locale use - fix RHEL-25559 - more: make sure we have data on stderr - fix RHEL-34165 - lsipc: fix semaphore USED counter - fix RHEL-25265 - libblkid: Check offset in LUKS2 header - fix RHEL-25559 - more: fix poll() use - lscpu: another tests update (RHEL-12783) - lscpu: update tests, follow max freq for scaling (RHEL-12783) - fix RHEL-16048 - uninitialized memory in SCM_CREDENTIALS in logger(1) - fix RHEL-21257 - logger sending process start time not current time with log messages - fix RHEL-16071 - issues in libblkid - fix RHEL-12783 - lscpu -e doesn't show the current real frequency value - fix RHEL-14612 - Userspace mount options are not preserved for NFS - Update to libndp 1.9 - Convert the license tag to SPDX format Related: RHELMISC-1363 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - expect/conntrack: Avoid spurious covscan overrun warning - conntrack: fix build with kernel 5.15 and musl - New version 1.0.9 - conntrack: don't cancel nest on unknown layer 4 protocols - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.0.8 - Cleanup spec - Bump release for CI - libnfnetlink: Check getsockname() return code - include: Silence gcc warning in linux_list.h - Replace statfs64 with statfs (RHEL-127105) - NFS export symlink vulnerability fix (RHEL-127105) - mountd: Minor refactor of get_rootfh() (RHEL-127105) - mountd: Separate lookup of the exported directory and the mount path (RHEL-127105) - support: Add a mini-library to extract and apply RPC credentials (RHEL-127105) - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127105) - Add requires for selinux-policy (RHEL-127105) Resolves: CVE-2025-12801 - gssd: protect kerberos ticket cache access (RHEL-138462) - nfsrahead: modify get_device_info logic (RHEL-134397) - Fix dependency definition in rpc-statd.service (RHEL-116079) - ensure services are stopped when nfs-utils is uninstalled (RHEL-88422) - gssd.man: add documentation for use-gss-proxy nfs.conf option (RHEL-85408) - gssd: do not use krb5_cc_initialize (RHEL-85412) - mountstats: verify that old and new types are the same (RHEL-88553) - nfs(5): Add new rdirplus functionality, clarify (RHEL-87143) - nfsd: allow more than 64 backlogged connections (RHEL-87752) - mountstats/nfsiostat: bugfixes for iostat (RHEL-72243) - Add nfs.conf to nfsv4-client-utils package (RHEL-72013) - Bump release for side-tag build with fixed libmnl (Phil Sutter) [RHEL-28515] - tests: Fix objref test case (Phil Sutter) [RHEL-28515] - expr: Respect data_len when setting attributes (Phil Sutter) [RHEL-28515] - obj: Respect data_len when setting attributes (Phil Sutter) [RHEL-28515] - utils: Introduce and use nftnl_set_str_attr() (Phil Sutter) [RHEL-28515] - obj: Enforce attr_policy compliance in nftnl_obj_set_data() (Phil Sutter) [RHEL-28515] - obj: Introduce struct obj_ops::attr_policy (Phil Sutter) [RHEL-28515] - obj: Call obj_ops::set with legal attributes only (Phil Sutter) [RHEL-28515] - obj: Repurpose struct obj_ops::max_attr field (Phil Sutter) [RHEL-28515] - obj: Return value on setters (Phil Sutter) [RHEL-28515] - object: getters take const struct (Phil Sutter) [RHEL-28515] - utils: Fix for wrong variable use in nftnl_assert_validate() (Phil Sutter) [RHEL-28515] - obj: synproxy: Use memcpy() to handle potentially unaligned data (Phil Sutter) [RHEL-28515] - obj: Do not call nftnl_obj_set_data() with zero data_len (Phil Sutter) [RHEL-28515] - table: Validate NFTNL_TABLE_OWNER, too (Phil Sutter) [RHEL-28515] - set: Validate NFTNL_SET_ID, too (Phil Sutter) [RHEL-28515] - obj: Validate NFTNL_OBJ_TYPE, too (Phil Sutter) [RHEL-28515] - flowtable: Validate NFTNL_FLOWTABLE_SIZE, too (Phil Sutter) [RHEL-28515] - table: Validate NFTNL_TABLE_USE, too (Phil Sutter) [RHEL-28515] - chain: Validate NFTNL_CHAIN_USE, too (Phil Sutter) [RHEL-28515] - expr: Enforce attr_policy compliance in nftnl_expr_set() (Phil Sutter) [RHEL-28515] - expr: Introduce struct expr_ops::attr_policy (Phil Sutter) [RHEL-28515] - include: Sync nf_log.h with kernel headers (Phil Sutter) [RHEL-28515] - expr: Call expr_ops::set with legal types only (Phil Sutter) [RHEL-28515] - expr: Repurpose struct expr_ops::max_attr field (Phil Sutter) [RHEL-28515] - udata: incorrect userdata buffer size validation (Phil Sutter) [RHEL-28515] - obj: ct_timeout: setter checks for timeout array boundaries (Phil Sutter) [RHEL-28515] - set_elem: use nftnl_data_cpy() in NFTNL_SET_ELEM_{KEY,KEY_END,DATA} (Phil Sutter) [RHEL-28515] - set: buffer overflow in NFTNL_SET_DESC_CONCAT setter (Phil Sutter) [RHEL-28515] - expr: fix buffer overflows in data value setters (Phil Sutter) [RHEL-28515] - spec: Avoid variable name clash, add missing dist tag (Phil Sutter) [RHEL-14149] - set: Do not leave free'd expr_list elements in place (Phil Sutter) [RHEL-14149] - Rebase onto version 1.2.6 (Phil Sutter) [RHEL-14149] - New version 1.2.2 - Fix debug printing for tcp option reset expression - new version 1.2.1 - fix Denial of service: Assertion failure due to the missing state validation (CVE-2026-27135) - fix CONTINUATION frames DoS (CVE-2024-28182, CVE-2024-27316) - fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055) - fix Denial of service: Assertion failure due to the missing state validation (CVE-2026-27135) - Update to 3.11.0 release (RHEL-67129) - Update to 3.9.0 release (RHEL-17843) - Update to 3.8.0 release (RHEL-17843) - Update to 3.11.0 release (RHEL-67129) - Update to 3.9.0 release (RHEL-17843) - Update to 3.8.0 release (RHEL-17843) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix linked list corruption RHEL-146273 - Respin for RHEL-114102 - Rebase to version 1.16.1 (RHEL-114102) - Update to version 1.13 (RHEL-88847) - TLS Fixes (RHEL-53980) - Update libnvme to version 1.11 (RHEL-67145) - Update to latest upstream version RHEL-61573 - Backport fix for RHEL-49544 - Backport URI parser API - Rebase to version 1.9 - Resolves: rhbz#2048667 - Request to add libdhash-devel package into CRB - Resolves: rhbz#1938708 - review of important potential issues detected by static analyzers in ding-libs-0.6.1-47.el9 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: rhbz#1962772 - Add gating tests for ding-libs in RHEL 9 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: #1938778 - review of important potential issues detected by static analyzers in libpcap - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - New version 1.10.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Using make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Enabling rdma support in libpcap - libpcap should print an error on wrong IPv4 address - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix CVE-2026-0799: add bounds checks for BPF scratch memory register indices in the BPF interpreter Related: RHEL-256935 - Fix findings from static application security testing (SAST) Resolves: https://issues.redhat.com/browse/RHEL-29753 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 + libpeas-1.30.0-3 - Correct license for some of the icons - Resolves: rhbz#1971434 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 1.30.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.28.0 + libpeas-1.26.0-5 - Remove unused Python macro that caused errors on install (#1863667) - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - update to 1.5.3 resolves: #1868648 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - update to 1.5.2 resolves #1787794 - Don't prepend sysroot_dir if pkg-config file lies outside of sysroot_dir resolves: rhbz#1975416 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Conditionalize the unit tests, disable them on RHEL 9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use internal target platform definition for pkg-config wrapper - Fix pkg-config wrapper for armv7hl - Make /usr/bin/pkg-config multilib safe - Add /usr/local paths to pkg-config(1) search path for non RPM builds - Update to 1.7.3 - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161448) - fix CVE-2026-33636: out-of-bounds R/W in the palette expansion on ARM Neon (RHEL-161299) - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148411) - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-147356) - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-149000) - CVE-2025-64720: buffer overflow (RHEL-131594) - CVE-2025-65018: heap buffer overflow (RHEL-131603) - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133294) - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148411) - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-147356) - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-149000) - CVE-2025-64720: buffer overflow (RHEL-131594) - CVE-2025-65018: heap buffer overflow (RHEL-131603) - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133294) - Drop networkmanager subpackage. Resolves: rhbz#1996028 - Drop pacrunner subpackage. Resolves: rhbz#1990974 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add Copyright.txt. Resolves: rhbz#1986586 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Tweak KDE conditionals to only apply at runtime - Depend on KDE only on Fedora (#1902608) - Disable mozjs backend by default, obsolete it by webkit subpackage - Fix PAC buffer overflow (#1883584) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - update to 0.21.1 (#1858489) - fix unnecessary build failure due to missing tree_index.sgml in gtk-doc output - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Explicitly rebuild the localization - Resolves: rhbz#1938621 - rebuilt - added i18n updates for de, fr, ja, ko, zh_CN - Resolves: rhbz#1963858 - Resolves: rhbz#1938621 - cracklib-dicts is a hard requirement, not a recomendation. - Resolves rhbz#1947882 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Resolves rhbz#1919026 libpwquaily rpm requires cracklib-dict to function but RPM missing requirement - Translation updates - Fix regression with enabling the cracklib check during build - Multiple translation updates - Add usersubstr check for substrings of N characters from the username patch by Danny Sauer - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Update to 1.32.2 - Include libqrtr build dependency (rh #2032807) - Update to 1.30.2 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.26.8 - Update to 1.32.2 - Include libqrtr build dependency (rh #2032807) - Update to 1.30.2 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.26.8 - Update to 1.2.2 - Rebuild with CI gating enabled - Import the fedora 35 srpm to CentOS 9 stream. - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Initial package - Rebuilt for gating testing - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Rebase to upstream release v61.0 - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - bump release to rebuild in sidetag - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - bump release to rebuild in sidetag - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Rebase to upstream release v60.0 - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Fix pyverbs tests - Resolves: RHEL-107929, RHEL-107930 - Rebase to upstream release v57.0 - Resolves: RHEL-76570, RHEL-45644, RHEL-72077, RHEL-68506, RHEL-94449 - Fix data corruption in bnxt_re - Resolves: RHEL-89179 - Rebase to upstream release v54.0 - Resolves: RHEL-52886, RHEL-54647, RHEL-51876 - Rebase to upstream release v51.0 - Resolves: RHEL-24473, RHEL-23180 - Rebuilt for gating testing - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Rebase to upstream release v61.0 - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - bump release to rebuild in sidetag - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - bump release to rebuild in sidetag - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Rebase to upstream release v60.0 - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Fix pyverbs tests - Resolves: RHEL-107929, RHEL-107930 - Rebase to upstream release v57.0 - Resolves: RHEL-76570, RHEL-45644, RHEL-72077, RHEL-68506, RHEL-94449 - Fix data corruption in bnxt_re - Resolves: RHEL-89179 - Rebase to upstream release v54.0 - Resolves: RHEL-52886, RHEL-54647, RHEL-51876 - Rebase to upstream release v51.0 - Resolves: RHEL-24473, RHEL-23180 - Resolves: rhbz#2048667 - Request to add libdhash-devel package into CRB - Resolves: rhbz#1938708 - review of important potential issues detected by static analyzers in ding-libs-0.6.1-47.el9 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: rhbz#1962772 - Add gating tests for ding-libs in RHEL 9 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebase to 1.19.0 (RHEL-62033) - Propagate return value from prepare_repo_download_targets (RHEL-85607) - Add support for AlmaLinux Bug Tracker - Remove libreport-rhel-bugzilla and libreport-rhel-anaconda-bugzilla - [reporter-bugzilla] Retry XML-RPC calls - Resolves: rhbz#2037399 - [reporter-bugzilla] Fix subcomponent handling - Resolves: rhbz#2037399 - Change the default Bugzilla group - Resolves: rhbz#2037399 - Rebuild against json-c-0.14-11 Related: rhbz#2023322 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - New upstream version 2.15.2 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Drop AnacondaRHEL workflow reference - Fix memory leaks in parse_entitlement_data() (RHEL-25499) - Correct a License tag to LGPLv2+ (RHEL-16103) - Fix relocating certificate paths to /etc/rhsm-host (RHEL-14224) - fix devel-usability test - rebase to 2.5.2 resolves: rhbz#2019887 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Apply fixes to change internal handling of the notification fd (#1865802) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - New upstream version (#1858965) - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Modernize spec - Backport fix for missing __SNR_ppoll symbol (#1777889) - Refresh patch to build on aarch64 with upstream version - New upstream version (#1765314) - Close old selabel handle when setting a new one (RHEL-76472) - restorecon: Include <selinux/label.h> (RHEL-50821, RHEL-54385) - SELinux userspace 3.6 release - SELinux userspace 3.6-rc1 release - SELinux userspace 3.5 release - SELinux userspace 3.5-rc3 release - Close old selabel handle when setting a new one (RHEL-76472) - restorecon: Include <selinux/label.h> (RHEL-50821, RHEL-54385) - SELinux userspace 3.6 release - SELinux userspace 3.6-rc1 release - SELinux userspace 3.5 release - SELinux userspace 3.5-rc3 release - improve performance of semanage store rebuild (RHEL-79100) - Set new restorecon handle before doing restorecon (RHEL-76472) - open lock_file with O_RDWR (RHEL-60503) - Preserve file context and ownership in policy store (RHEL-31216, RHEL-54389) - SELinux userspace 3.6 release - SELinux userspace 3.6-rc1 release - Include more parameters in the module checksum (#2173959) - Fix static analyzer issues (RHEL-28966) - sepol_compute_sid: Do not destroy uninitialized context (RHEL-28964) - SELinux userspace 3.6 release - SELinux userspace 3.6-rc1 release - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 2.13 - spec file cleanup - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix configure tests compromised by LTO - fix RHEL-132706 - use sysusers.d for uuidd - fix RHEL-133956 - login-utils: fix setpwnam() buffer use [CVE-2025-14104] - fix RHEL-123527 - mount: improve --all documentation - fix RHEL-123531 - libblkid: use snprintf() instead of sprintf() - fix RHEL-123536 - libfdisk: (dos) fix off-by-one in maximum last sector calculation - fix RHEL-113638 - lscpu: update ARM identifiers - fix RHEL-108386 - libblkid: (jmicron_raid) backport checksum verification - fix RHEL-56354 - lib/timeutils: parse_timestamp: fix second parsing - fix RHEL-56983 - sulogin: fix POSIX locale use - fix RHEL-25559 - more: make sure we have data on stderr - fix RHEL-34165 - lsipc: fix semaphore USED counter - fix RHEL-25265 - libblkid: Check offset in LUKS2 header - fix RHEL-25559 - more: fix poll() use - lscpu: another tests update (RHEL-12783) - lscpu: update tests, follow max freq for scaling (RHEL-12783) - fix RHEL-16048 - uninitialized memory in SCM_CREDENTIALS in logger(1) - fix RHEL-21257 - logger sending process start time not current time with log messages - fix RHEL-16071 - issues in libblkid - fix RHEL-12783 - lscpu -e doesn't show the current real frequency value - fix RHEL-14612 - Userspace mount options are not preserved for NFS - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - Backport "Implement color filtering when adding update targets" Resolves: RHEL-103995 - Some static analysis fixes for unitialized structs Resolves: RHEL-25498 - Fix a memory leak in parse_package() of repo conda (RHEL-25496) - Backport "choice rules: also do solver_choicerulecheck for package downgrades" Resolves: RHEL-141449 - Backport "Implement color filtering when adding update targets" Resolves: RHEL-103995 - Fix a buffer overflow when decompressing solv pages (CVE-2026-48864) (RHEL-178982) - Backport "choice rules: also do solver_choicerulecheck for package downgrades" Resolves: RHEL-141449 - Backport "Implement color filtering when adding update targets" Resolves: RHEL-103995 - ext2fs: make sure we have at least EXT2_FIRST_INO + 1 inodes - Fix: e2fsprogs: online resize fails - Related: RHEL-76095 - Bump release to perform build verification for gating changes - Related: RHEL-71250 - rebuild to incorporate libss-devel package - Related: RHEL-19059 - Change the xattr entry hash to use an unsighed char by default - Related: RHEL-10467 - Resolves: RHEL-150661 - Resolves: CVE-2025-4877 - Resolves: CVE-2025-4878 - Resolves: CVE-2025-5351 - Resolves: CVE-2025-8114 - Resolves: CVE-2025-8277 - Resolves: CVE-2026-0964 - Resolves: CVE-2026-0965 - Resolves: CVE-2026-0966 - Resolves: CVE-2026-0967 - Resolves: CVE-2026-0968 - Bump spec to resolve build tagging issues - Fix CVE-2025-5987 Resolves: RHEL-130051 - Workaround sshd failure rate limiting in tests Resolves: RHEL-135506 - Bump spec to make the 9.7 NVR higher than the 9.6 one - Fix CVE-2025-5318 Resolves: RHEL-111732 - Bump up the version so that the version in 9.3 is lower. - Resolves: RHEL-19310, RHEL-19691, RHEL-17245 - Backport CVE patches from 0.11.5 Resolves: RHEL-213033 Resolves: RHEL-213041 Resolves: RHEL-213047 Resolves: RHEL-213081 Resolves: RHEL-213114 Resolves: RHEL-213119 Resolves: RHEL-213151 - Resolves: RHEL-150661 - Resolves: CVE-2025-4877 - Resolves: CVE-2025-4878 - Resolves: CVE-2025-5351 - Resolves: CVE-2025-8114 - Resolves: CVE-2025-8277 - Resolves: CVE-2026-0964 - Resolves: CVE-2026-0965 - Resolves: CVE-2026-0966 - Resolves: CVE-2026-0967 - Resolves: CVE-2026-0968 - Bump spec to resolve build tagging issues - Fix CVE-2025-5987 Resolves: RHEL-130051 - Workaround sshd failure rate limiting in tests Resolves: RHEL-135506 - Bump spec to make the 9.7 NVR higher than the 9.6 one - Fix CVE-2025-5318 Resolves: RHEL-111732 - Resolves: RHEL-150661 - Resolves: CVE-2025-4877 - Resolves: CVE-2025-4878 - Resolves: CVE-2025-5351 - Resolves: CVE-2025-8114 - Resolves: CVE-2025-8277 - Resolves: CVE-2026-0964 - Resolves: CVE-2026-0965 - Resolves: CVE-2026-0966 - Resolves: CVE-2026-0967 - Resolves: CVE-2026-0968 - Bump spec to resolve build tagging issues - Fix CVE-2025-5987 Resolves: RHEL-130051 - Workaround sshd failure rate limiting in tests Resolves: RHEL-135506 - Bump spec to make the 9.7 NVR higher than the 9.6 one - Fix CVE-2025-5318 Resolves: RHEL-111732 - Bump up the version so that the version in 9.3 is lower. - Resolves: RHEL-19310, RHEL-19691, RHEL-17245 - Backport CVE patches from 0.11.5 Resolves: RHEL-213033 Resolves: RHEL-213041 Resolves: RHEL-213047 Resolves: RHEL-213081 Resolves: RHEL-213114 Resolves: RHEL-213119 Resolves: RHEL-213151 - Resolves: RHEL-150661 - Resolves: CVE-2025-4877 - Resolves: CVE-2025-4878 - Resolves: CVE-2025-5351 - Resolves: CVE-2025-8114 - Resolves: CVE-2025-8277 - Resolves: CVE-2026-0964 - Resolves: CVE-2026-0965 - Resolves: CVE-2026-0966 - Resolves: CVE-2026-0967 - Resolves: CVE-2026-0968 - Bump spec to resolve build tagging issues - Fix CVE-2025-5987 Resolves: RHEL-130051 - Workaround sshd failure rate limiting in tests Resolves: RHEL-135506 - Bump spec to make the 9.7 NVR higher than the 9.6 one - Fix CVE-2025-5318 Resolves: RHEL-111732 - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Debrand for AlmaLinux - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding branches and calls to gcov output, but not conditions (RHEL-105416). - Fix testsuite failures when run with -fstack-protector* (PR testsuite/70230, RHEL-116477) - Add cross compilers for ppc64le and s390x for non-production uses (RHEL-94764) - Adjust glibc32 build dependency (RHEL-105072) - Exception handling performance improvements (RHEL-105072) - libgcc: Use _dl_find_object to find DWARF data in unwinder - libgcc: Use lock-free data structures for run-time unwinder registration - Pin modification time for python files to SOURCE_DATE_EPOCH (RHEL-100148). - Sync libstdc++ pretty printers to latest GTS (RHEL-81975) - Fix folding of BIT_NOT_EXPR for POLY_INT_CST (PR 118976, RHEL-90239) - rs6000: Rework ELFv2 support for -fpatchable-function-entry (PR target/99888, RHEL-75806) - Fix erroneous my_strncat implementation Resolves: RHEL-83777 - Rebase to version 2.4.3 - resolves: RHEL-89882 - resolves: RHEL-33758 - Rebase to version 2.4.2 - resolves: RHEL-16479 - Rebase to version 2.4.1 - resolves: rhbz#2190418 - Rebuilt to retrigger brew build - Backport the fix for CVE-2025-13151 (RHEL-139568) - Backport the fix for CVE-2024-12133 (RHEL-78580) - Backport the fix for CVE-2024-12133 (RHEL-78580) - Update to version 1.4.14 - resolves: RHEL-114549 - Update to version 1.4.13 - resolves: RHEL-89880 - Update to version 1.4.12 - resolves: RHEL-59791 - resolves: RHEL-33756 - Rebase to version 1.4.10 - resolves: RHEL-16480 - Rebase to version 1.4.9 - fix the Requires package name for teamd-devel - teamd: stop iterating callbacks when a loop restart is requested (rhbz#2148852) - teamd: do no remove the ports on shutdown with -N (rhbz#2148854) - Rebuilt with a new version to pass the fixed gating test (rhbz#2060445) - utils/team2bond: do not add updelay/downdelay if already exist (rhbz#2060445) - utils/team2bond: do not add miimon if already exist (rhbz#2060445) - Revert "teamd: Disregard current state when considering port enablement" [1894546] - Remove an extra line in spec file - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Build util team2bond in teamd rpm [1986788] - Add some cautions to util team2bond [1986788] - Add team2bond man doc [1986788] - gating: fix the wrong link of openvswitch for RHEL-9 [1970175] - Update to version 0.17.1 - resolves: RHEL-114550 - Update to version 0.16.2 - resolves: RHEL-89881 - resolves: RHEL-33755 - Rebase to version 0.16.1 - resolves: RHEL-16481 - Rebase to version 0.16.0 - Support abstract addresses for rpcbind (RHEL-47027) - rpcb_clnt.c (fixed): Eliminate double frees in delete_cache() (RHEL-11183) - exception build (RHEL-11183) - rpcb_clnt.c: Eliminate double frees in delete_cache() (RHEL-11183) - Fix rpc_gss_seccreate() usage of the passed in gss credential. (RHEL-27936) - Add gating tests (rhel-7883) - Null pointers so they are not used again (RHEL-11371) - getnetconfigent: avoid potential DoS (bz 2150611) - bindresvport.c: fix a potential resource leakage (bz 2135405) - clnt_raw.c: fix a possible null pointer dereference (bz 2138317) - Rebased to libtirpc-1.3.3 (bz 2118157) - Harden libltdl loaders (RHEL-39991) - Fix trace messages (RHEL-86597) - Rebuild without side-tags (RHEL-76155) - Rebase to version 3.3.1 (RHEL-76155) - Rebuild without side-tags (RHEL-67585) - Rebase to 1.8.4 (RHEL-67585) - Rebuild without side-tags (RHEL-81923) - Rebase to 1.8.1 (Related: RHEL-76155) - Rebase to 1.6.4 (RHEL-36547) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Related rhbz#1938800: Fix CI tests and convert them to tmt - Related rhbz#1938800: Fix spelling in license GPLV2+ -> GPLv2+ - Fix memory leak in vasnprint. Resolves: rhbz#1938800 (Backported from upstream: https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=4d288a80bf7ebe29334b9805cdcc70eacb6059c1) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Pull in new upstream libusb containing important regression fixes Resolves: #2058730 Resolves: #1938801 - Updated and new regression fixes Resolves: #2058730 Related: #1938801 - Fix a crash if a transfer outlives closing the device Related: #1938801 - Update to 1.0.25 - Fix a crash after libusb_exit API has been misused - Add patchset to fix covscan reports Resolves: #1938801 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Pull in upstream bugfixes Resolves: #1929148 - Update to 1.0.24 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to upstream version 1.0.30 to include the major bug fixes - Include the necessary API for fwupd backporting to RHEL9. Resolves: RHEL-183213 - create temporary edit files at symlink target location (RHEL-85754) - allow 32 char usernames (#RHEL-55983) - Update translations Resolves: RHEL-12110 - Fix findings from static application security testing Resolves: RHEL-35693 - Translation update Resolves: rhbz#2139662 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 1.2.1 (#1854129) - Update to 1.2.0 (#1831940) - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - fix RHEL-132706 - use sysusers.d for uuidd - fix RHEL-133956 - login-utils: fix setpwnam() buffer use [CVE-2025-14104] - fix RHEL-123527 - mount: improve --all documentation - fix RHEL-123531 - libblkid: use snprintf() instead of sprintf() - fix RHEL-123536 - libfdisk: (dos) fix off-by-one in maximum last sector calculation - fix RHEL-113638 - lscpu: update ARM identifiers - fix RHEL-108386 - libblkid: (jmicron_raid) backport checksum verification - fix RHEL-56354 - lib/timeutils: parse_timestamp: fix second parsing - fix RHEL-56983 - sulogin: fix POSIX locale use - fix RHEL-25559 - more: make sure we have data on stderr - fix RHEL-34165 - lsipc: fix semaphore USED counter - fix RHEL-25265 - libblkid: Check offset in LUKS2 header - fix RHEL-25559 - more: fix poll() use - lscpu: another tests update (RHEL-12783) - lscpu: update tests, follow max freq for scaling (RHEL-12783) - fix RHEL-16048 - uninitialized memory in SCM_CREDENTIALS in logger(1) - fix RHEL-21257 - logger sending process start time not current time with log messages - fix RHEL-16071 - issues in libblkid - fix RHEL-12783 - lscpu -e doesn't show the current real frequency value - fix RHEL-14612 - Userspace mount options are not preserved for NFS - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - New upstream version (0.3.2) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream version (0.3.1) - Drop tevent goo and RHEL conditionals - Rebuild for libevent soname bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - New upstream version (0.3.2) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream version (0.3.1) - Drop tevent goo and RHEL conditionals - Rebuild for libevent soname bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - New upstream release - Add explicit BR: perl-core - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream release - Add a patch to add support for LTO builds - Enable LTO - Add a patch to fix Wformat-overflow - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Disable LTO - Trim %changelog starting with v4.4.0 - Remove memcheck conditional - Explicitly force linking with '-Wl,-z,defs' - Rebuilt for the correct target in RHEL (9.7-z) (RHEL-119283) - Fix CVE-2025-9714 (RHEL-119283) - Fix CVE-2025-32415 (RHEL-100182) - Fix CVE-2025-32414 (RHEL-99873) - Fix CVE-2025-7425 (RHEL-102806) - Fix CVE-2025-6021 (RHEL-96507) - Fix CVE-2025-49794 (RHEL-96405) - Fix CVE-2025-49796 (RHEL-96431) - Fix CVE-2025-24928 (RHEL-80142) - Fix CVE-2024-56171 (RHEL-80127) - Fix CVE-2022-49043 (RHEL-76298) - Fix CVE-2024-25062 (RHEL-29196) - Fix CVE-2024-34459 (RHEL-177882) - Rebuilt for the correct target in RHEL (9.7-z) (RHEL-119283) - Fix CVE-2025-9714 (RHEL-119283) - Fix CVE-2025-32415 (RHEL-100182) - Fix CVE-2025-32414 (RHEL-99873) - Fix CVE-2025-7425 (RHEL-102806) - Fix CVE-2025-6021 (RHEL-96507) - Fix CVE-2025-49794 (RHEL-96405) - Fix CVE-2025-49796 (RHEL-96431) - Fix CVE-2025-24928 (RHEL-80142) - Fix CVE-2024-56171 (RHEL-80127) - Fix CVE-2022-49043 (RHEL-76298) - Fix CVE-2025-6170 (RHEL-182016) - Fix CVE-2024-34459 (RHEL-177882) - Rebuilt for the correct target in RHEL (9.7-z) (RHEL-119283) - Fix CVE-2025-9714 (RHEL-119283) - Fix CVE-2025-32415 (RHEL-100182) - Fix CVE-2025-32414 (RHEL-99873) - Fix CVE-2025-7425 (RHEL-102806) - Fix CVE-2025-6021 (RHEL-96507) - Fix CVE-2025-49794 (RHEL-96405) - Fix CVE-2025-49796 (RHEL-96431) - Fix CVE-2025-24928 (RHEL-80142) - Fix CVE-2024-56171 (RHEL-80127) - Fix CVE-2022-49043 (RHEL-76298) - Fix CVE-2026-11979 (RHEL-215568) - Fix CVE-2026-6653 (RHEL-215619) - Fix CVE-2025-6170 (RHEL-182016) - Fix CVE-2024-34459 (RHEL-177882) - Rebuilt for the correct target in RHEL (9.7-z) (RHEL-119283) - Fix CVE-2025-9714 (RHEL-119283) - Fix CVE-2025-32415 (RHEL-100182) - Fix CVE-2025-32414 (RHEL-99873) - Fix CVE-2025-7425 (RHEL-102806) - Fix CVE-2025-6021 (RHEL-96507) - Fix CVE-2025-49794 (RHEL-96405) - Fix CVE-2025-49796 (RHEL-96431) - Fix CVE-2025-24928 (RHEL-80142) - Fix CVE-2026-86144 (RHEL-256304) - Fix CVE-2026-86140 (RHEL-256027) - Fix CVE-2026-74860 (RHEL-256120) - Fix CVE-2026-86142 (RHEL-256365) - Fix CVE-2026-86143 (RHEL-256901) - Fix CVE-2026-86138 (RHEL-256953) - Fix CVE-2026-11979 (RHEL-215568) - Fix CVE-2026-6653 (RHEL-215619) - Fix CVE-2025-6170 (RHEL-182016) - Fix CVE-2024-34459 (RHEL-177882) - Rebuilt for the correct target in RHEL (9.7-z) (RHEL-119283) - Fix CVE-2025-9714 (RHEL-119283) - Fix CVE-2025-32415 (RHEL-100182) - Fix CVE-2025-32414 (RHEL-99873) - Fix CVE-2025-7425 (RHEL-102806) - Fix CVE-2025-6021 (RHEL-96507) - Fix CVE-2025-49794 (RHEL-96405) - Fix CVE-2025-49796 (RHEL-96431) - Rebase to 0.3.24 - Add missing libzstd-devel BuildRequires - Add missing files to the %files tests section - Resolves: RHEL-116442 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Add BuildRequires for make (re: https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - New upstream release (rhbz#1842769) - New upstream release (rhbz#1825622) - Fixes document end before directive (rhbz#1824226) - New upstream release (rhbz#1823108) - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebase to 1.5.5 Resolves: RHEL-62221 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - man doc update and one fix for lib and another for sctp_test. Related: RHEL-25098 - Bring back one RHEL specific patch to fix the installation issue. Related: rhbz#2031786 - do not remove config when stopping lldpad (RHEL-61874) - Rebase to latest upstream code - Remove interface configure if the interface deleted (RHEL-13242) - Fix strdup is not freed (RHEL-37524) - Fix using uninitialized value (RHEL-37548) - Fix copy past error (RHEL-37679) - Fix resource leak (RHEL-37685) - Update gating test - Rebase to 1.1.1 - Fix program segfaults after entering the quit command (RHEL-5814) - Fix setting interface status not survive reboot (RHEL-5824) - Fix some other bugs - Convert the license tag to SPDX format (RHELMISC-1358) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Upgrade to version 0.9.29 - Upgrade to version 0.9.28 - Specfile refactoring - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Upgrade to version 0.9.27 - Upgrade to version 0.9.26 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Upgrade to version 0.9.25 - Use OpenLDAP git directly in place of GitHub mirror - Fix memory leaks found by static analysis - Resolves: RHEL-80167 - allow to disable state management (RHEL-69959) - fix memory corruption issues in config file parsing (RHEL-91449) - allow to disable state management (RHEL-69959) - config: introduce `ignoreduplicates` configuration directive (#RHEL-5711) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix long-standing SIGSEGV bug when using the -s parameter without an argument (RHEL-282108) - Backport tightened path handling from 0.13.1 (CVE-2026-105840) - Remove 'Topipe' feature. (CVE-2026-105841) - Release B.02.20-4 update to upstream latest(209f8306e95) - Release B.02.20-3 update to upstream latest(af7c69e1b6e) - Release B.02.20-2 update to upstream latest(98b74f64e76) - Release B.02.20-1 update to upstream latest(9372b680418) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebase to 4.94.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix the gating tests - Rebase to proper upstream 0.32 release (r167) - Fix WWN ID truncation (#1981038) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 0.32 upstream snapshot - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - update to 0.31 (#1758436) - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Disable bootstrap mode forgotten on 5.4 rebase (#2135419) - Apply upstream patch for CVE-2022-28805 - Resolves CVE-2021-43519 - Rebase to lua 5.4.4 - Resolves CVE-2021-44964 - Fix up CVE-2022-33099 patch - Enable gating - apply upstream fix for CVE-2022-33099 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Handle wrong XFS reported size when shrinking LV immediately after growing. - Allow integrity to use multiple segments for metadata. - Add message when activating RAID volumes with snapshots. - Update to upstream version 2.03.33. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix vgremove hanging immediately after lockstart. - Add repair option for RAID volumes with too many transiently failed devices. - Update to upstream version 2.03.32. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix race causing lvm2 not recognizing active devices. - Fix temporary LVs not cleaned when converting in use LV to a thin pool. - Check FS resize is supported before extending LV. - Fix issue affecting memory locking before suspend (2.03.27). - Workaround for NVMe WWID changing after kernel update. - Fix duplicate LV names when converting pools to RAID1 with more than 2 legs. - Fix false positive warnings about stray FDs on s390x. - Handle wrong XFS reported size when shrinking LV immediately after growing. - Allow integrity to use multiple segments for metadata. - Add message when activating RAID volumes with snapshots. - Update to upstream version 2.03.33. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix vgremove hanging immediately after lockstart. - Add repair option for RAID volumes with too many transiently failed devices. - Update to upstream version 2.03.32. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix race causing lvm2 not recognizing active devices. - Fix temporary LVs not cleaned when converting in use LV to a thin pool. - Check FS resize is supported before extending LV. - Fix issue affecting memory locking before suspend (2.03.27). - Workaround for NVMe WWID changing after kernel update. - Handle wrong XFS reported size when shrinking LV immediately after growing. - Allow integrity to use multiple segments for metadata. - Add message when activating RAID volumes with snapshots. - Update to upstream version 2.03.33. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix vgremove hanging immediately after lockstart. - Add repair option for RAID volumes with too many transiently failed devices. - Update to upstream version 2.03.32. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix race causing lvm2 not recognizing active devices. - Fix temporary LVs not cleaned when converting in use LV to a thin pool. - Check FS resize is supported before extending LV. - Fix issue affecting memory locking before suspend (2.03.27). - Workaround for NVMe WWID changing after kernel update. - Fix duplicate LV names when converting pools to RAID1 with more than 2 legs. - Fix false positive warnings about stray FDs on s390x. - Handle wrong XFS reported size when shrinking LV immediately after growing. - Allow integrity to use multiple segments for metadata. - Add message when activating RAID volumes with snapshots. - Update to upstream version 2.03.33. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix vgremove hanging immediately after lockstart. - Add repair option for RAID volumes with too many transiently failed devices. - Update to upstream version 2.03.32. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix race causing lvm2 not recognizing active devices. - Fix temporary LVs not cleaned when converting in use LV to a thin pool. - Check FS resize is supported before extending LV. - Fix issue affecting memory locking before suspend (2.03.27). - Workaround for NVMe WWID changing after kernel update. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fix cve-2021-3520 resolves: cve-2021-3520 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.9.3 and switch to Meson - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 1.9.1 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fix cve-2021-3520 resolves: cve-2021-3520 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.9.3 and switch to Meson - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 1.9.1 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Release bump to drop unused patches from the dist-git Resolves: rhbz#1956457 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Disable -fno-strict-aliasing (RHBZ#1807737) - Update to 2.10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebase to 2.1.49 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Don't try to execute directories (RHEL-22829) - Fix patch to increase MAX_NAME to 16384 - Resolves: RHEL-93724 - Increase MAX_NAME to 16384 - Resolves: RHEL-93724 - suffixes(7): Add zstd format to the suffixes file - core(5): Document dump file format change from lz4 format to zstd format Resolves: RHEL-152440 - madvise(2): madvise can return EBUSY on MADV_SOFT_OFFLINE requests. Resolves: RHEL-34105 - Document RWF_ATOMIC, STATX_ATTR_WRITE_ATOMIC flags (RHEL-87625) - Break up man-pages-additional-20140218.tar.xz - Add rtas.2, swapcontext.2 and cons.saver.8 man pages as a patch. Resolves: RHEL-101596 - Remove POSIX man-pages to comply with licensing guidelines. Resolves: RHEL-101595 - sched(7): Mention autogroup disabled behavior. Resolves: RHEL-67690 - Activate previously added patch to improve mktime documentation and add 3 related upstream patches including an example. Related: RHEL-58342 - Add note about tm_isdst handling in mktime(3) - Resolves: RHEL-58342 - Add RTLD_DI_PHDR to dlinfo(3) - Resolves: RHEL-53953 - madvise(2): madvise can return EBUSY on MADV_SOFT_OFFLINE requests. Resolves: RHEL-34105 - Document RWF_ATOMIC, STATX_ATTR_WRITE_ATOMIC flags (RHEL-87625) - Break up man-pages-additional-20140218.tar.xz - Add rtas.2, swapcontext.2 and cons.saver.8 man pages as a patch. Resolves: RHEL-101596 - Remove POSIX man-pages to comply with licensing guidelines. Resolves: RHEL-101595 - sched(7): Mention autogroup disabled behavior. Resolves: RHEL-67690 - Activate previously added patch to improve mktime documentation and add 3 related upstream patches including an example. Related: RHEL-58342 - Add note about tm_isdst handling in mktime(3) - Resolves: RHEL-58342 - Add RTLD_DI_PHDR to dlinfo(3) - Resolves: RHEL-53953 - SELinux userspace 3.6 release - SELinux userspace 3.6-rc1 release - SELinux userspace 3.5 release - SELinux userspace 3.5-rc3 release - SELinux userspace 3.5-rc2 release - SELinux userspace 3.5-rc1 release - SELinux userspace 3.4 release - Update to latest upstream - Resolves RHEL-100087, RHEL-107083 - mdadm grow command can't work - Resolves RHEL-92270 - Update to mdadm 4.4 - Resolves RHEL-87288 RHEL-72801 RHEL-88792 RHEL-88790 RHEL-63402 RHEL-72756 - Update to latest upstream - Resolves RHEL-52059 RHEL-40729 RHEL-31448 - /dev/md symlink not created for second RAID container - Resolves RHEL-50456 - Update to latest upstream - Resolves RHEL-36424 - Update to 4.3 and to latest upstream - Resolves RHEL-30529 - To fix errata/osci problems - Resolves RHEL-26272 - revert "mdadm: remove container_enough logic" - Resolves RHEL-26272 - Update to latest upstream - Resolves RHEL-15386 - enable sync del mode and some booting fixes - Resolves RHEL-106747 RHEL-130808 - udev change and don't stop array during assemble - Resolves RHEL-130808 RHEL-106747 - mdadm grow command can't work - Resolves RHEL-92270 - Update to mdadm 4.4 - Resolves RHEL-87288 RHEL-72801 RHEL-88792 RHEL-88790 RHEL-63402 RHEL-72756 - Update to latest upstream - Resolves RHEL-52059 RHEL-40729 RHEL-31448 - /dev/md symlink not created for second RAID container - Resolves RHEL-50456 - Update to latest upstream - Resolves RHEL-36424 - Update to 4.3 and to latest upstream - Resolves RHEL-30529 - To fix errata/osci problems - Resolves RHEL-26272 - revert "mdadm: remove container_enough logic" - Resolves RHEL-26272 - Set md_mod parameter legacy_async_del_gendisk only when the running kernel provides it - enable sync del mode and some booting fixes - Resolves RHEL-106747 RHEL-130808 - udev change and don't stop array during assemble - Resolves RHEL-130808 RHEL-106747 - mdadm grow command can't work - Resolves RHEL-92270 - Update to mdadm 4.4 - Resolves RHEL-87288 RHEL-72801 RHEL-88792 RHEL-88790 RHEL-63402 RHEL-72756 - Update to latest upstream - Resolves RHEL-52059 RHEL-40729 RHEL-31448 - /dev/md symlink not created for second RAID container - Resolves RHEL-50456 - Bump release - Fix UEFI backward compatibility for IMSM RAID10. - Update to latest upstream - Resolves RHEL-100087, RHEL-107083 - mdadm grow command can't work - Resolves RHEL-92270 - Update to mdadm 4.4 - Resolves RHEL-87288 RHEL-72801 RHEL-88792 RHEL-88790 RHEL-63402 RHEL-72756 - Update to latest upstream - Resolves RHEL-52059 RHEL-40729 RHEL-31448 - Fix 'device ready' notification for udev during container incremental assembly. - Version adjustment. - Fix UEFI backward compatibility for IMSM RAID10. - Update to latest upstream - Resolves RHEL-100087, RHEL-107083 - mdadm grow command can't work - Resolves RHEL-92270 - Update to mdadm 4.4 - Resolves RHEL-87288 RHEL-72801 RHEL-88792 RHEL-88790 RHEL-63402 RHEL-72756 - Update to latest upstream - Resolves RHEL-52059 RHEL-40729 RHEL-31448 - Update Intel CPU microcode to microcode-20260512 release () - Update Intel CPU microcode to microcode-20260210 release (RHEL-151757) - Microcode files (/platform_mask shown) with revision updates (in hex): 06-6a-06/87: Ice Lake-X: d000410 to d000421 06-6c-01/10: Ice Lake-D: 10002e0 to 10002f1 06-7e-05/80: Ice Lake-L: 00ca to 00cc 06-8c-01/80: Tiger Lake: 00bc to 00be 06-8c-02/c2: Tiger Lake: 003c to 003e 06-8d-01/c2: Tiger Lake-H: 0056 to 0058 06-8f-07/87: Sapphire Rapids: 2b000650 to 2b000661 06-8f-08/10: Sapphire Rapids with HBM: 2c000410 to 2c000421 06-8f-08/87: Sapphire Rapids: 2b000650 to 2b000661 06-97-02/07: Alder Lake: 003d to 003e 06-97-05/07: Alder Lake: 003d to 003e 06-9a-03/80: Alder Lake-L: 043a to 043b 06-9a-04/80: Alder Lake-L: 043a to 043b 06-9a-04/40: Arizona Beach (Atom C11xx): 000b to 000c 06-9a-04/80: Alder Lake-L: 043a to 043b 06-a7-01/02: Rocket Lake: 0064 to 0065 06-aa-04/e6: Meteor Lake-L: 0025 to 0028 06-ad-01/20: Granite Rapids-X: a000124 to a000133 06-ad-01/95: Granite Rapids-X: 10003f0 to 1000405 06-ae-01/97: Granite Rapids-D: 1000273 to 10002f3 06-b5-00/80: Arrow Lake-U: 000a to 000d 06-b7-01/32: Raptor Lake: 0132 to 0133 06-ba-02/e0: Raptor Lake-P: 6133 to 6134 06-ba-03/e0: Raptor Lake-P: 6133 to 6134 06-be-00/19: Gracemont (Alder Lake-N): 001e to 0021 06-bf-02/07: Raptor Lake-S: 003d to 003e 06-bf-05/07: Raptor Lake-S: 003d to 003e 06-c5-02/82: Arrow Lake-H: 011a to 011b 06-c6-02/82: Arrow Lake: 011a to 011b 06-cf-02/87: Emerald Rapids: 210002c0 to 210002d3 Resolves: RHEL-151757 - Fix typo in /usr/share/microcode_ctl/ucode_with_caveats/intel-06-8f-08/config - Update Intel CPU microcode to microcode-20251111 release (RHEL-128199) - New microcode files (in hex): 06-ae-01: Granite Rapids-D: revision 1000273 - Microcode files (/platform_mask shown) with revision updates (in hex): 06-8f-07/87: Sapphire Rapids: 2b000643 to 2b000650 06-8f-08/10: Sapphire Rapids with HBM: 2c000401 to 2c000410 06-8f-08/87: Sapphire Rapids: 2b000643 to 2b000650 06-97-02/07: Alder Lake: 003a to 003d 06-97-05/07: Alder Lake: 003a to 003d 06-9a-03/80: Alder Lake-L: 0437 to 043a 06-9a-04/80: Alder Lake-L: 0437 to 043a 06-9a-04/40: Arizona Beach (Atom C11xx): 000a to 000b 06-ad-01/95: Granite Rapids-X: 10003d0 to 10003f0 06-ad-01/20: Granite Rapids-X: a000100 to a000124 06-af-03/01: Crestmont (Sierra Forest): 3000362 to 3000382 06-b7-01/32: Raptor Lake: 012f to 0132 06-ba-02/e0: Raptor Lake-P: 4129 to 6133 06-ba-03/e0: Raptor Lake-P: 4129 to 6133 06-bd-01/80: Lunar Lake: 0123 to 0125 06-be-00/19: Gracemont (Alder Lake-N): 001d to 001e 06-bf-02/07: Raptor Lake-S: 003a to 003d 06-bf-05/07: Raptor Lake-S: 003a to 003d 06-c5-02/82: Arrow Lake-H: 0119 to 011a 06-c6-02/82: Arrow Lake: 0119 to 011a 06-cf-02/87: Emerald Rapids: 210002b3 to 210002c0 - Fixes errata RPL070/ADL083/LNL047/ARL054/SPR154/EMR147: "REP SCASB, REP CMPSB may return incorrect results when racing memory access with another core or thread" on Raptor Lake, Alder Lake, Lunar Lake, Arrow Lake, Sapphire Rapids, Emerald Rapids. - Update Intel CPU microcode to microcode-20250812 release - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000404 up to 0xd000410; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002d0 up to 0x10002e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b000639 up to 0x2b000643; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x24 up to 0x25; - Update of 06-ad-01/0x20 (GNR-AP/SP H0) microcode from revision 0xa0000d1 up to 0xa000100; - Update of 06-ad-01/0x95 (GNR-AP/SP B0) microcode from revision 0x10003a2 up to 0x10003d0; - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000341 up to 0x3000362; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4128 up to 0x4129; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4128 up to 0x4129; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4128 up to 0x4129; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4128 up to 0x4129; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4128 up to 0x4129; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4128 up to 0x4129; - Update of 06-bd-01/0x80 (LNL B0) microcode from revision 0x11f up to 0x123; - Update of 06-c5-02/0x82 (ARL-H A1) microcode from revision 0x118 up to 0x119; - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in intel-ucode/06-c5-02) from revision 0x118 up to 0x119; - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) from revision 0x118 up to 0x119; - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) from revision 0x118 up to 0x119; - Update of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02) from revision 0x118 up to 0x119; - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode from revision 0x118 up to 0x119; - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) from revision 0x118 up to 0x119; - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) from revision 0x118 up to 0x119; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x210002a9 up to 0x210002b3; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x210002a9 up to 0x210002b3. - Add a caveat to provide ability to persistently disable SPR-EE updates beyond 0x2b0005c0 on systems where absence of latency spikes is more important than lack of the latest CVE mitigations. - Update Intel CPU microcode to microcode-20250512 release, addresses CVE-2024-28956, CVE-2025-20103, CVE-2025-20054, CVE-2024-43420, CVE-2025-20623, CVE-2024-45332, CVE-2025-24495, CVE-2025-20012 (RHEL-94294, RHEL-91231, RHEL-91224, RHEL-91224, RHEL-91239) - Addition of 06-8f-04/0x10 microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-06/0x10 microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-ad-01/0x20 (GNR-AP/SP H0) microcode at revision 0xa0000d1; - Addition of 06-ad-01/0x95 (GNR-AP/SP B0) microcode at revision 0x10003a2; - Addition of 06-b5-00/0x80 (ARL-U A1) microcode at revision 0xa; - Addition of 06-bd-01/0x80 (LNL B0) microcode at revision 0x11f; - Addition of 06-c5-02/0x82 (ARL-H A1) microcode at revision 0x118; - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in intel-ucode/06-c5-02) at revision 0x118; - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) at revision 0x118; - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) at revision 0x118; - Addition of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02) at revision 0x118; - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode at revision 0x118; - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) at revision 0x118; - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) at revision 0x118; - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xb8 up to 0xbc; - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from revision 0xfc up to 0x100; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0x102 up to 0x104; - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision 0x5003707 up to 0x5003901; - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002904 up to 0x7002b01; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003f5 up to 0xd000404; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002c0 up to 0x10002d0; - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x24 up to 0x26; - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc6 up to 0xca; - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x38 up to 0x3c; - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x52 up to 0x56; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-06/0x10 microcode from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x436 up to 0x437; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x436 up to 0x437; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x436 up to 0x437; - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x9 up to 0xa; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x436 up to 0x437; - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfc up to 0x100; - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfc up to 0x100; - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfc up to 0x100; - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfe up to 0x102; - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision 0xfc up to 0x100; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x63 up to 0x64; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x20 up to 0x24; - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000330 up to 0x3000341; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12c up to 0x12f; - Update of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) from revision 0x12c up to 0x12f; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4124 up to 0x4128; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4124 up to 0x4128; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128; - Update of 06-ba-08/0xe0 microcode from revision 0x4124 up to 0x4128; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1c up to 0x1d; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000291 up to 0x210002a9; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) from revision 0x21000291 up to 0x210002a9; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x21000291 up to 0x210002a9; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000291 up to 0x210002a9. - Update Intel CPU microcode to microcode-20250211 release, addresses CVE-2023-34440, CVE-2023-43758, CVE-2024-24582, CVE-2024-28047, CVE-2024-28127, CVE-2024-29214, CVE-2024-31068, CVE-2024-31157, CVE-2024-37020, CVE-2024-39279, CVE-2024-39355, CVE-2024-36293 (RHEL-79182, RHEL-79186, RHEL-79187, RHEL-79242, RHEL-79243, RHEL-79246, RHEL-79251, RHEL-79252): - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) at revision 0x38; - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) at revision 0x38; - Addition of 06-af-03/0x01 (SRF-SP C0) microcode at revision 0x3000330; - Addition of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) at revision 0x12c; - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) at revision 0x38; - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) at revision 0x38; - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xf8 up to 0xfa; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0x100 up to 0x102; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003e7 up to 0xd0003f5; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002b0 up to 0x10002c0; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-05) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-06) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x10 microcode from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-06) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x37 up to 0x38; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x37 up to 0x38; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x435 up to 0x436; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x435 up to 0x436; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x435 up to 0x436; - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x7 up to 0x9; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x435 up to 0x436; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x62 up to 0x63; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12b up to 0x12c; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4123 up to 0x4124; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4123 up to 0x4124; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4123 up to 0x4124; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4123 up to 0x4124; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4123 up to 0x4124; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4123 up to 0x4124; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4123 up to 0x4124; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4123 up to 0x4124; - Update of 06-ba-08/0xe0 microcode from revision 0x4123 up to 0x4124; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1a up to 0x1c; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x37 up to 0x38; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x37 up to 0x38; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000283 up to 0x21000291; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) from revision 0x21000283 up to 0x21000291; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x21000283 up to 0x21000291; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000283 up to 0x21000291. - Update Intel CPU microcode to microcode-20241112 release, addresses CVE-2024-21820, CVE-2024-21853, CVE-2024-23918, CVE-2024-23984 (RHEL-67336): - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x36 up to 0x37; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x36 up to 0x37; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x434 up to 0x435; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x434 up to 0x435; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x434 up to 0x435; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x434 up to 0x435; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x1f up to 0x20; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x129 up to 0x12b; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4122 up to 0x4123; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4122 up to 0x4123; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4122 up to 0x4123; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4122 up to 0x4123; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4122 up to 0x4123; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4122 up to 0x4123; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4122 up to 0x4123; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4122 up to 0x4123; - Update of 06-ba-08/0xe0 microcode from revision 0x4122 up to 0x4123; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x36 up to 0x37; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x36 up to 0x37; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000230 up to 0x21000283; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) from revision 0x21000230 up to 0x21000283; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x21000230 up to 0x21000283; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000230 up to 0x21000283. - Update Intel CPU microcode to microcode-20240910 release, addresses CVE-2024-23984, CVE-2024-24853, CVE-2024-24968, CVE-2024-24980, CVE-2024-25939 (RHEL-58057): - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xb6 up to 0xb8; - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xf4 up to 0xf6; - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xf4 up to 0xf6; - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xf4 up to 0xf6; - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xf4 up to 0xf6; - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from revision 0xfa up to 0xfc; - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xf6 up to 0xf8; - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xf4 up to 0xf6; - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xf6 up to 0xf8; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xfc up to 0x100; - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision 0x5003605 up to 0x5003707; - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002802 up to 0x7002904; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003d1 up to 0xd0003e7; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000290 up to 0x10002b0; - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc4 up to 0xc6; - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x36 up to 0x38; - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x50 up to 0x52; - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x19 up to 0x1a; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x35 up to 0x36; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x35 up to 0x36; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x433 up to 0x434; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x433 up to 0x434; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x433 up to 0x434; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x433 up to 0x434; - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfa up to 0xfc; - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfa up to 0xfc; - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfa up to 0xfc; - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfa up to 0xfe; - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision 0xfa up to 0xfc; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x5e up to 0x62; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x1c up to 0x1f; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x123 up to 0x129; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4121 up to 0x4122; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4121 up to 0x4122; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4121 up to 0x4122; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4121 up to 0x4122; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4121 up to 0x4122; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4121 up to 0x4122; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4121 up to 0x4122; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4121 up to 0x4122; - Update of 06-ba-08/0xe0 microcode from revision 0x4121 up to 0x4122; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x35 up to 0x36; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x35 up to 0x36; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x17 up to 0x1a (old pf 0x11). - Update Intel CPU microcode to microcode-20260812 release (RHEL-240771) - Security advisories: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01379.html CVE-2025-31936 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01404.html CVE-2025-31938 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01423.html CVE-2026-20917 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01428.html CVE-2025-35973 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01435.html CVE-2026-20716 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01441.html CVE-2026-20760 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01442.html CVE-2026-20713, CVE-2026-20901 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01443.html CVE-2026-20707 - New microcode files (in hex): 06-b7-04: Raptor Lake: revision 0137 06-cc-02: Panther Lake: revision 011c 06-cc-03: Panther Lake: revision 011c 06-d5-01: Wildcat Lake: revision 000c 06-d7-00: Bartlett Lake: revision 0137 - Microcode files (/platform_mask shown) with revision updates (in hex): 06-6a-06/87: Ice Lake-X: d000421 to d000433 06-6c-01/10: Ice Lake-D: 10002f1 to 1000301 06-7e-05/80: Ice Lake-L: 00cc to 00ce 06-8f-07/87: Sapphire Rapids: 2b000661 to 2b000685 06-8f-08/10: Sapphire Rapids with HBM: 2c000421 to 2c000435 06-8f-08/87: Sapphire Rapids: 2b000661 to 2b000685 06-a7-01/02: Rocket Lake: 0065 to 0066 06-ad-01/20: Granite Rapids-X: a000133 to a000151 06-ad-01/95: Granite Rapids-X: 1000405 to 1000434 06-ae-01/97: Granite Rapids-D: 10002f3 to 1000309 06-af-03/01: Crestmont (Sierra Forest): 3000382 to 30003b2 06-b5-00/80: Arrow Lake-U: 000d to 000e 06-b7-01/36: Raptor Lake: 0133 to 0137, platform bit 04 added 06-bd-01/80: Lunar Lake: 0125 to 0128 06-c5-02/82: Arrow Lake-H: 011b to 0122 06-c6-02/82: Arrow Lake: 011b to 0122 06-cf-02/87: Emerald Rapids: 210002d3 to 210002f4 - Update Intel CPU microcode to microcode-20260210 release (RHEL-151757) - Microcode files (/platform_mask shown) with revision updates (in hex): 06-6a-06/87: Ice Lake-X: d000410 to d000421 06-6c-01/10: Ice Lake-D: 10002e0 to 10002f1 06-7e-05/80: Ice Lake-L: 00ca to 00cc 06-8c-01/80: Tiger Lake: 00bc to 00be 06-8c-02/c2: Tiger Lake: 003c to 003e 06-8d-01/c2: Tiger Lake-H: 0056 to 0058 06-8f-07/87: Sapphire Rapids: 2b000650 to 2b000661 06-8f-08/10: Sapphire Rapids with HBM: 2c000410 to 2c000421 06-8f-08/87: Sapphire Rapids: 2b000650 to 2b000661 06-97-02/07: Alder Lake: 003d to 003e 06-97-05/07: Alder Lake: 003d to 003e 06-9a-03/80: Alder Lake-L: 043a to 043b 06-9a-04/80: Alder Lake-L: 043a to 043b 06-9a-04/40: Arizona Beach (Atom C11xx): 000b to 000c 06-9a-04/80: Alder Lake-L: 043a to 043b 06-a7-01/02: Rocket Lake: 0064 to 0065 06-aa-04/e6: Meteor Lake-L: 0025 to 0028 06-ad-01/20: Granite Rapids-X: a000124 to a000133 06-ad-01/95: Granite Rapids-X: 10003f0 to 1000405 06-ae-01/97: Granite Rapids-D: 1000273 to 10002f3 06-b5-00/80: Arrow Lake-U: 000a to 000d 06-b7-01/32: Raptor Lake: 0132 to 0133 06-ba-02/e0: Raptor Lake-P: 6133 to 6134 06-ba-03/e0: Raptor Lake-P: 6133 to 6134 06-be-00/19: Gracemont (Alder Lake-N): 001e to 0021 06-bf-02/07: Raptor Lake-S: 003d to 003e 06-bf-05/07: Raptor Lake-S: 003d to 003e 06-c5-02/82: Arrow Lake-H: 011a to 011b 06-c6-02/82: Arrow Lake: 011a to 011b 06-cf-02/87: Emerald Rapids: 210002c0 to 210002d3 Resolves: RHEL-151757 - Fix typo in /usr/share/microcode_ctl/ucode_with_caveats/intel-06-8f-08/config - Update Intel CPU microcode to microcode-20251111 release (RHEL-128199) - New microcode files (in hex): 06-ae-01: Granite Rapids-D: revision 1000273 - Microcode files (/platform_mask shown) with revision updates (in hex): 06-8f-07/87: Sapphire Rapids: 2b000643 to 2b000650 06-8f-08/10: Sapphire Rapids with HBM: 2c000401 to 2c000410 06-8f-08/87: Sapphire Rapids: 2b000643 to 2b000650 06-97-02/07: Alder Lake: 003a to 003d 06-97-05/07: Alder Lake: 003a to 003d 06-9a-03/80: Alder Lake-L: 0437 to 043a 06-9a-04/80: Alder Lake-L: 0437 to 043a 06-9a-04/40: Arizona Beach (Atom C11xx): 000a to 000b 06-ad-01/95: Granite Rapids-X: 10003d0 to 10003f0 06-ad-01/20: Granite Rapids-X: a000100 to a000124 06-af-03/01: Crestmont (Sierra Forest): 3000362 to 3000382 06-b7-01/32: Raptor Lake: 012f to 0132 06-ba-02/e0: Raptor Lake-P: 4129 to 6133 06-ba-03/e0: Raptor Lake-P: 4129 to 6133 06-bd-01/80: Lunar Lake: 0123 to 0125 06-be-00/19: Gracemont (Alder Lake-N): 001d to 001e 06-bf-02/07: Raptor Lake-S: 003a to 003d 06-bf-05/07: Raptor Lake-S: 003a to 003d 06-c5-02/82: Arrow Lake-H: 0119 to 011a 06-c6-02/82: Arrow Lake: 0119 to 011a 06-cf-02/87: Emerald Rapids: 210002b3 to 210002c0 - Fixes errata RPL070/ADL083/LNL047/ARL054/SPR154/EMR147: "REP SCASB, REP CMPSB may return incorrect results when racing memory access with another core or thread" on Raptor Lake, Alder Lake, Lunar Lake, Arrow Lake, Sapphire Rapids, Emerald Rapids. - Update Intel CPU microcode to microcode-20250812 release - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000404 up to 0xd000410; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002d0 up to 0x10002e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b000639 up to 0x2b000643; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x24 up to 0x25; - Update of 06-ad-01/0x20 (GNR-AP/SP H0) microcode from revision 0xa0000d1 up to 0xa000100; - Update of 06-ad-01/0x95 (GNR-AP/SP B0) microcode from revision 0x10003a2 up to 0x10003d0; - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000341 up to 0x3000362; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4128 up to 0x4129; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4128 up to 0x4129; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4128 up to 0x4129; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4128 up to 0x4129; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4128 up to 0x4129; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4128 up to 0x4129; - Update of 06-bd-01/0x80 (LNL B0) microcode from revision 0x11f up to 0x123; - Update of 06-c5-02/0x82 (ARL-H A1) microcode from revision 0x118 up to 0x119; - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in intel-ucode/06-c5-02) from revision 0x118 up to 0x119; - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) from revision 0x118 up to 0x119; - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) from revision 0x118 up to 0x119; - Update of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02) from revision 0x118 up to 0x119; - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode from revision 0x118 up to 0x119; - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) from revision 0x118 up to 0x119; - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) from revision 0x118 up to 0x119; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x210002a9 up to 0x210002b3; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x210002a9 up to 0x210002b3. - Add a caveat to provide ability to persistently disable SPR-EE updates beyond 0x2b0005c0 on systems where absence of latency spikes is more important than lack of the latest CVE mitigations. - Update Intel CPU microcode to microcode-20250512 release, addresses CVE-2024-28956, CVE-2025-20103, CVE-2025-20054, CVE-2024-43420, CVE-2025-20623, CVE-2024-45332, CVE-2025-24495, CVE-2025-20012 (RHEL-94294, RHEL-91231, RHEL-91224, RHEL-91224, RHEL-91239) - Addition of 06-8f-04/0x10 microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-06/0x10 microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-ad-01/0x20 (GNR-AP/SP H0) microcode at revision 0xa0000d1; - Addition of 06-ad-01/0x95 (GNR-AP/SP B0) microcode at revision 0x10003a2; - Addition of 06-b5-00/0x80 (ARL-U A1) microcode at revision 0xa; - Addition of 06-bd-01/0x80 (LNL B0) microcode at revision 0x11f; - Addition of 06-c5-02/0x82 (ARL-H A1) microcode at revision 0x118; - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in intel-ucode/06-c5-02) at revision 0x118; - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) at revision 0x118; - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) at revision 0x118; - Addition of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02) at revision 0x118; - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode at revision 0x118; - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) at revision 0x118; - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) at revision 0x118; - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xb8 up to 0xbc; - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from revision 0xfc up to 0x100; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0x102 up to 0x104; - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision 0x5003707 up to 0x5003901; - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002904 up to 0x7002b01; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003f5 up to 0xd000404; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002c0 up to 0x10002d0; - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x24 up to 0x26; - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc6 up to 0xca; - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x38 up to 0x3c; - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x52 up to 0x56; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-06/0x10 microcode from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x436 up to 0x437; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x436 up to 0x437; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x436 up to 0x437; - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x9 up to 0xa; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x436 up to 0x437; - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfc up to 0x100; - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfc up to 0x100; - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfc up to 0x100; - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfe up to 0x102; - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision 0xfc up to 0x100; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x63 up to 0x64; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x20 up to 0x24; - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000330 up to 0x3000341; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12c up to 0x12f; - Update of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) from revision 0x12c up to 0x12f; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4124 up to 0x4128; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4124 up to 0x4128; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128; - Update of 06-ba-08/0xe0 microcode from revision 0x4124 up to 0x4128; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1c up to 0x1d; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000291 up to 0x210002a9; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) from revision 0x21000291 up to 0x210002a9; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x21000291 up to 0x210002a9; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000291 up to 0x210002a9. - Update Intel CPU microcode to microcode-20250211 release, addresses CVE-2023-34440, CVE-2023-43758, CVE-2024-24582, CVE-2024-28047, CVE-2024-28127, CVE-2024-29214, CVE-2024-31068, CVE-2024-31157, CVE-2024-37020, CVE-2024-39279, CVE-2024-39355, CVE-2024-36293 (RHEL-79182, RHEL-79186, RHEL-79187, RHEL-79242, RHEL-79243, RHEL-79246, RHEL-79251, RHEL-79252): - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) at revision 0x38; - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) at revision 0x38; - Addition of 06-af-03/0x01 (SRF-SP C0) microcode at revision 0x3000330; - Addition of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) at revision 0x12c; - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) at revision 0x38; - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) at revision 0x38; - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xf8 up to 0xfa; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0x100 up to 0x102; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003e7 up to 0xd0003f5; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002b0 up to 0x10002c0; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-05) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-06) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x10 microcode from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-06) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x37 up to 0x38; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x37 up to 0x38; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x435 up to 0x436; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x435 up to 0x436; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x435 up to 0x436; - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x7 up to 0x9; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x435 up to 0x436; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x62 up to 0x63; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12b up to 0x12c; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4123 up to 0x4124; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4123 up to 0x4124; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4123 up to 0x4124; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4123 up to 0x4124; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4123 up to 0x4124; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4123 up to 0x4124; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4123 up to 0x4124; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4123 up to 0x4124; - Update of 06-ba-08/0xe0 microcode from revision 0x4123 up to 0x4124; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1a up to 0x1c; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x37 up to 0x38; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x37 up to 0x38; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000283 up to 0x21000291; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) from revision 0x21000283 up to 0x21000291; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x21000283 up to 0x21000291; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000283 up to 0x21000291. - Update Intel CPU microcode to microcode-20241112 release, addresses CVE-2024-21820, CVE-2024-21853, CVE-2024-23918, CVE-2024-23984 (RHEL-67336): - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x36 up to 0x37; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x36 up to 0x37; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x434 up to 0x435; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x434 up to 0x435; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x434 up to 0x435; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x434 up to 0x435; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x1f up to 0x20; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x129 up to 0x12b; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4122 up to 0x4123; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4122 up to 0x4123; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4122 up to 0x4123; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4122 up to 0x4123; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4122 up to 0x4123; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4122 up to 0x4123; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4122 up to 0x4123; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4122 up to 0x4123; - Update of 06-ba-08/0xe0 microcode from revision 0x4122 up to 0x4123; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x36 up to 0x37; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x36 up to 0x37; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000230 up to 0x21000283; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) from revision 0x21000230 up to 0x21000283; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x21000230 up to 0x21000283; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000230 up to 0x21000283. - Update Intel CPU microcode to microcode-20240910 release, addresses CVE-2024-23984, CVE-2024-24853, CVE-2024-24968, CVE-2024-24980, CVE-2024-25939 (RHEL-58057): - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xb6 up to 0xb8; - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xf4 up to 0xf6; - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xf4 up to 0xf6; - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xf4 up to 0xf6; - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xf4 up to 0xf6; - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from revision 0xfa up to 0xfc; - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xf6 up to 0xf8; - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xf4 up to 0xf6; - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xf6 up to 0xf8; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xfc up to 0x100; - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision 0x5003605 up to 0x5003707; - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002802 up to 0x7002904; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003d1 up to 0xd0003e7; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000290 up to 0x10002b0; - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc4 up to 0xc6; - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x36 up to 0x38; - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x50 up to 0x52; - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x19 up to 0x1a; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x35 up to 0x36; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x35 up to 0x36; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x433 up to 0x434; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x433 up to 0x434; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x433 up to 0x434; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x433 up to 0x434; - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfa up to 0xfc; - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfa up to 0xfc; - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfa up to 0xfc; - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfa up to 0xfe; - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision 0xfa up to 0xfc; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x5e up to 0x62; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x1c up to 0x1f; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x123 up to 0x129; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4121 up to 0x4122; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4121 up to 0x4122; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4121 up to 0x4122; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4121 up to 0x4122; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4121 up to 0x4122; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4121 up to 0x4122; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4121 up to 0x4122; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4121 up to 0x4122; - Update of 06-ba-08/0xe0 microcode from revision 0x4121 up to 0x4122; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x35 up to 0x36; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x35 up to 0x36; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x17 up to 0x1a (old pf 0x11). - Bump release (needed to rebuild) - Revert: leaves: Treat recommends as dependencies when install_weak_deps=True - Revert: Add leaves command - Update to 3.9.1 - leaves: Treat recommends as dependencies when install_weak_deps=True - Add leaves command - Remove non-breaking space from "Size" column (RhBug:2010676) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Update to 3.8.0 - distrosync: Fix style issues and plugin build with Meson - Add distro-sync subcommand - Add "makecache" command - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 3.7.1 - [download] fix: unwanted dependency on newer glib - [download] Support for "--resolve" and "--alldeps" arguments - [download] New get_packages_query function - Support "--setopt=keepcache=0/1" - [download] Support "--archlist=" argument - [download] Move package download code to "download_packages" function - [download] several optimizations - Don't set default value of "assumeyes" to TRUE - Support for user confirmation and assumeyes, assumeno, defaultyes - Extend "--setopt" to support repository options - Added alias "update" to "upgrade" command - Command "update" renamed to "upgrade" - Add support for command aliases - dnf-data requirement only for Fedora and future RHEL - Relicense to GPLv2+ [errata corrige: not in 3.5.1-1] - Sync summary and description from openSUSE [errata corrige: not in 3.6.0-1] - Update to 3.6.0 - spec: Sync summary and description from openSUSE - Add support for setting a platform module ID - Add dependency for DNF configurations skeleton - Add support for setting allow_vendor_change - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fix build with gcc 10 - Resolves: rhbz#1799652 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - fix postun scriptlet (RHEL-129957) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Don't prune bind mounts on ostree based systems, prune the deployments folder there to avoid duplications. - Fixes: https://github.com/fedora-silverblue/issue-tracker/issues/76 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Bump release - Resolves: #RHEL-90837 - Return zero in case --test-key is enrolled - Resolves: #RHEL-90837 - Rebase several patches from upstream which: - Introduce --is-sb-enabled parameter and better return codes - Remove unused int_to_b64() - Show help on unsupported systems - Resolves: #RHEL-90837 - Bump version to 0.7.2 upstream tag - Resolves: #RHEL-88741 - add /usr/share/doc/mpfr ownership to the doc subpackage as well (RHEL-36690) - add /usr/share/doc/mpfr ownership (RHEL-36690) - fix use of uninitialized value in sin_cos (RHEL-35392) - Increase error message buffer size - Prevent a leak of iconv_t - Prevent a file descriptor leak - add smoke test - Change UDP and ICMP sockets binding to accept a source IP from the -a CLI option - avoid a leak when linter aborts after producing parsable output (RHEL-51175) - fix emergency file replacement vulnerability (RHEL-35237) - remove execute permissions from ANNOUNCE file (RHEL-101067) - guard against corrupt terminfo data in string conversion (CVE-2022-29458 RHEL-100135) - ignore TERMINFO and HOME only if setuid/setgid/capability (#2211666) - fix buffer overflow on terminfo with too many capabilities (CVE-2023-29491) - ignore TERMINFO and HOME environment variables if running as root (#2211666) - remove execute permissions from ANNOUNCE file (RHEL-101067) - guard against corrupt terminfo data in string conversion (CVE-2022-29458 RHEL-100135) - ignore TERMINFO and HOME only if setuid/setgid/capability (#2211666) - fix buffer overflow on terminfo with too many capabilities (CVE-2023-29491) - ignore TERMINFO and HOME environment variables if running as root (#2211666) - remove execute permissions from ANNOUNCE file (RHEL-101067) - guard against corrupt terminfo data in string conversion (CVE-2022-29458 RHEL-100135) - ignore TERMINFO and HOME only if setuid/setgid/capability (#2211666) - fix buffer overflow on terminfo with too many capabilities (CVE-2023-29491) - ignore TERMINFO and HOME environment variables if running as root (#2211666) - Rebase to v82 - Resolve: RHEL-97669 - Add explicit package version requirements. (Jeff Moyer) - Related: RHEL-29151 - Rebase to v78 - Add support for legacy monitor.conf file location - Fix a test failure. - Resolves: RHEL-10382 - Resolves: RHEL-8204 - Resolves: RHEL-29151 - Rebase to v82 - Resolve: RHEL-97669 - Add explicit package version requirements. (Jeff Moyer) - Related: RHEL-29151 - Rebase to v78 - Add support for legacy monitor.conf file location - Fix a test failure. - Resolves: RHEL-10382 - Resolves: RHEL-8204 - Resolves: RHEL-29151 - Resolves: RHEL-40958 - Segmentation fault (core dumped) on netstat -s - Resolves: RHEL-31932 - Addressing findings from static application security testing - version bump - version bump - version bump - netconsole: var/lock -> run/lock - netconsole: source sysconfig/network only if it exists - netconsole: remove unused variables - netconsole: remove trailing whitespaces - sync spec with c9s - rename_device: free path after it is used - rename_device: remove trailing whitespaces - Add -r to while read as per shellcheck - Fix splitting spaces in paths from statetab files - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update to nettle 3.10.1 (RHEL-52740) - Update to nettle 3.9.1 (RHEL-14890) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - disable python2 subpackage on fedora >= 32 (#1763073) - Rebuilt for Python 3.8.0rc1 (#1748018) - Rebuilt for Python 3.8 - Replace statfs64 with statfs (RHEL-127105) - NFS export symlink vulnerability fix (RHEL-127105) - mountd: Minor refactor of get_rootfh() (RHEL-127105) - mountd: Separate lookup of the exported directory and the mount path (RHEL-127105) - support: Add a mini-library to extract and apply RPC credentials (RHEL-127105) - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127105) - Add requires for selinux-policy (RHEL-127105) Resolves: CVE-2025-12801 - gssd: protect kerberos ticket cache access (RHEL-138462) - nfsrahead: modify get_device_info logic (RHEL-134397) - Fix dependency definition in rpc-statd.service (RHEL-116079) - ensure services are stopped when nfs-utils is uninstalled (RHEL-88422) - gssd.man: add documentation for use-gss-proxy nfs.conf option (RHEL-85408) - gssd: do not use krb5_cc_initialize (RHEL-85412) - mountstats: verify that old and new types are the same (RHEL-88553) - nfs(5): Add new rdirplus functionality, clarify (RHEL-87143) - nfsd: allow more than 64 backlogged connections (RHEL-87752) - mountstats/nfsiostat: bugfixes for iostat (RHEL-72243) - Add nfs.conf to nfsv4-client-utils package (RHEL-72013) - Prepare gating tests (rhel-26256) - Rebuild: nfs4_getfacl: Initialize acl pointer to NULL (bz 2144829) - nfs4_getfacl: Initialize acl pointer to NULL (bz 2144829) - Updated to the latest upstream release: nfs4-acl-tools-0.4.2 (bz 2059052) - Revert doc/ part of "exthdr: add boolean DCCP option matching" (Phil Sutter) [RHEL-126817] - Revert doc/ part of "meta: introduce meta broute support" (Phil Sutter) [RHEL-126817] - Revert doc/ part of "src: add tcp option reset support" (Phil Sutter) [RHEL-126817] - spec: Update expected test suite results (Phil Sutter) [RHEL-126817] - tests: py: missing json output in never merge across non-expression statements (Phil Sutter) [RHEL-114095] - tests: py: add missing json.output data (Phil Sutter) [RHEL-114095] - tests: py: remove huge-limit test cases (Phil Sutter) [RHEL-114095] - datatype: rt_symbol_table_init() to search for iproute2 configs (Phil Sutter) [RHEL-114095] - tests: shell: connect chains to hook point (Phil Sutter) [RHEL-114095] - tests: shell: Fix sets/reset_command_0 for current kernels (Phil Sutter) [RHEL-114095] - parser_json: fix handle memleak from error path (Phil Sutter) [RHEL-88181] - json: deal appropriately with multidevice in chain (Phil Sutter) [RHEL-88181] - cache: Always set NFT_CACHE_TERSE for list cmd with --terse (Phil Sutter) [RHEL-45633] - Add support for table's persist flag (Phil Sutter) [RHEL-32122] - src: fix reset element support for interval set type (Phil Sutter) [RHEL-153461] - src: netlink: fix crash when ops doesn't support udata (Phil Sutter) [RHEL-153461] - Revert doc/ part of "exthdr: add boolean DCCP option matching" (Phil Sutter) [RHEL-126817] - Revert doc/ part of "meta: introduce meta broute support" (Phil Sutter) [RHEL-126817] - Revert doc/ part of "src: add tcp option reset support" (Phil Sutter) [RHEL-126817] - spec: Update expected test suite results (Phil Sutter) [RHEL-126817] - tests: py: missing json output in never merge across non-expression statements (Phil Sutter) [RHEL-114095] - tests: py: add missing json.output data (Phil Sutter) [RHEL-114095] - tests: py: remove huge-limit test cases (Phil Sutter) [RHEL-114095] - datatype: rt_symbol_table_init() to search for iproute2 configs (Phil Sutter) [RHEL-114095] - tests: shell: connect chains to hook point (Phil Sutter) [RHEL-114095] - tests: shell: Fix sets/reset_command_0 for current kernels (Phil Sutter) [RHEL-114095] - parser_json: fix handle memleak from error path (Phil Sutter) [RHEL-88181] - json: deal appropriately with multidevice in chain (Phil Sutter) [RHEL-88181] - cache: Always set NFT_CACHE_TERSE for list cmd with --terse (Phil Sutter) [RHEL-45633] - Add support for table's persist flag (Phil Sutter) [RHEL-32122] - netlink: add and use nft_data_memcpy helper (Phil Sutter) [RHEL-190549] - spec: Update expected test suite results (Phil Sutter) [RHEL-190549] - tests: monitor: Fix for out-of-path call (Phil Sutter) [RHEL-190549] - tests: monitor: Excercise all syntaxes and variants by default (Phil Sutter) [RHEL-190549] - tests: monitor: Test JSON echo mode as well (Phil Sutter) [RHEL-190549] - tests: monitor: Become $PWD agnostic (Phil Sutter) [RHEL-190549] - tests: monitor: Run in own netns (Phil Sutter) [RHEL-190549] - tests: monitor: Label diffs to help users (Phil Sutter) [RHEL-190549] - tests: monitor: Extend testcases a bit (Phil Sutter) [RHEL-190549] - tests: monitor: enclose device names in quotes (Phil Sutter) [RHEL-190549] - json: Dump flowtable hook spec only if present (Phil Sutter) [RHEL-190549] - tests: py: Fix some JSON equivalents (Phil Sutter) [RHEL-190549] - rule: constify set_is_non_concat_range() (Phil Sutter) [RHEL-190549] - datatype: don't return a const string from cgroupv2_get_path() (Phil Sutter) [RHEL-190549] - tests: py: Fix --keep test runner option (Phil Sutter) [RHEL-190549] - segtree: fix get element command with open intervals (Phil Sutter) [RHEL-190549] - segtree: replace default case by specific types in get_set_intervals() (Phil Sutter) [RHEL-190549] - src: remove EXPR_SET_ELEM in range_expr_value_{low,high}() (Phil Sutter) [RHEL-190549] - segtree: rename set_elem_add() to set_elem_expr_add() (Phil Sutter) [RHEL-190549] - parser_json: fix map/set type confusion crash in map statement parser (Phil Sutter) [RHEL-190549] - cache: honor -c/--check for reset commands (Phil Sutter) [RHEL-190549] - tests: py: osf is ip-only (Phil Sutter) [RHEL-190549] - tests: py: print the file name as intended (Phil Sutter) [RHEL-190549] - tests: py: don't use a fixed filename (Phil Sutter) [RHEL-190549] - mnl: Fix ordering of hooks in 'list hooks' output (Phil Sutter) [RHEL-190549] - segtree: Fix for variable-sized object may not be initialized (Phil Sutter) [RHEL-190549] - cache: Filter for table when listing flowtables (Phil Sutter) [RHEL-190549] - cache: Filter for table when listing sets or maps (Phil Sutter) [RHEL-190549] - cache: Respect family in all list commands (Phil Sutter) [RHEL-190549] - cache: Include chains, flowtables and objects in netlink debug output (Phil Sutter) [RHEL-190549] - cache: Relax chain_cache_dump filter application (Phil Sutter) [RHEL-190549] - parser_bison: add range check for synproxy wscale (Phil Sutter) [RHEL-190549] - json: complete multi-statement set element support (Phil Sutter) [RHEL-190549] - segtree: Fix range aggregation on Big Endian (Phil Sutter) [RHEL-190549] - mergesort: Align concatenation sort order with Big Endian (Phil Sutter) [RHEL-190549] - mergesort: Fix sorting of string values (Phil Sutter) [RHEL-190549] - tests: py: any/tcpopt.t.json: Fix JSON equivalent (Phil Sutter) [RHEL-190549] - expression: expr_build_udata_recurse should recurse (Phil Sutter) [RHEL-190549] - expression: propagate key datatype for anonymous sets (Phil Sutter) [RHEL-190549] - netlink_delinearize: also consider exthdr type when trimming binops (Phil Sutter) [RHEL-190549] - tcpopt: add symbol table for mptcp suboptions (Phil Sutter) [RHEL-190549] - monitor: fix memleak in setelem cb (Phil Sutter) [RHEL-190549] - tests: json_echo: Drop rule handle before multi-add (Phil Sutter) [RHEL-190549] - rule: skip CMD_OBJ_SETELEMS with no elements after set flush (Phil Sutter) [RHEL-190549] - doc: libnftables-json: Describe RULESET object (Phil Sutter) [RHEL-190549] - doc: don't suggest to disable GSO (Phil Sutter) [RHEL-190549] - tests: py: Implement payload_record() (Phil Sutter) [RHEL-190549] - tests: py: inet/osf.t: Fix element ordering in JSON equivalents (Phil Sutter) [RHEL-190549] - tests: py: Do not rely upon '[end]' marker (Phil Sutter) [RHEL-190549] - tests: py: Fix for using wrong payload path (Phil Sutter) [RHEL-190549] - tests: py: any/ct.t.json.output: Drop leftover entry (Phil Sutter) [RHEL-190549] - datatype: Fix boolean type on Big Endian (Phil Sutter) [RHEL-190549] - optimize: Fix verdict expression comparison (Phil Sutter) [RHEL-190549] - src: parser_json: fix format string bugs (Phil Sutter) [RHEL-190549] - doc: fix tcpdump example (Phil Sutter) [RHEL-190549] - tests: py: objects.t: must use input, not output (Phil Sutter) [RHEL-190549] - fib: Fix for existence check on Big Endian (Phil Sutter) [RHEL-190549] - tests: Prepare exit codes for automake (Phil Sutter) [RHEL-190549] - monitor: Inform JSON printer when reporting an object delete event (Phil Sutter) [RHEL-190549] - monitor: Recognize flowtable add/del events (Phil Sutter) [RHEL-190549] - tests: monitor: Fix regex collecting expected echo output (Phil Sutter) [RHEL-190549] - monitor: Quote device names in chain declarations, too (Phil Sutter) [RHEL-190549] - mnl: continue on ENOBUFS errors when processing batch (Phil Sutter) [RHEL-190549] - tests: monitor: Fix for flag arrays in JSON output (Phil Sutter) [RHEL-190549] - mnl: silence compiler warning (Phil Sutter) [RHEL-190549] - fib: restore JSON output for relational expressions (Phil Sutter) [RHEL-190549] - src: ensure chain policy evaluation when specified (Phil Sutter) [RHEL-190549] - segtree: incorrect type when aggregating concatenated set ranges (Phil Sutter) [RHEL-190549] - json: Do not reduce single-item arrays on output (Phil Sutter) [RHEL-190549] - tests: py: Fix tests added for 'icmpv6 taddr' support (Phil Sutter) [RHEL-190549] - tests: py: Drop stale entry from ip/snat.t.payload (Phil Sutter) [RHEL-190549] - tests: py: Drop stale entries from ip6/{ct,meta}.t.json (Phil Sutter) [RHEL-190549] - tests: py: Drop stale entry from ip/snat.t.json (Phil Sutter) [RHEL-190549] - tests: py: Drop duplicate test from inet/vxlan.t (Phil Sutter) [RHEL-190549] - tests: py: Drop stale entry from inet/tcp.t.json (Phil Sutter) [RHEL-190549] - tests: py: Drop duplicate test from inet/gretap.t (Phil Sutter) [RHEL-190549] - tests: py: Drop duplicate test from inet/gre.t (Phil Sutter) [RHEL-190549] - tests: py: Drop duplicate test from inet/geneve.t (Phil Sutter) [RHEL-190549] - tests: py: Drop stale entries since redundant test case removal (Phil Sutter) [RHEL-190549] - src: netlink: netlink_delinearize_table() may return NULL (Phil Sutter) [RHEL-190549] - doc: nft.8: Minor NAT STATEMENTS section review (Phil Sutter) [RHEL-190549] - mnl: Call mnl_attr_nest_end() just once (Phil Sutter) [RHEL-190549] - evaluate: validate set expression type before accessing flags (Phil Sutter) [RHEL-190549] - rule: print chain and flowtable devices in quotes (Phil Sutter) [RHEL-190549] - tests: py: re-enables nft-test.py to load the local nftables.py (Phil Sutter) [RHEL-190549] - fib: allow to use it in set statements (Phil Sutter) [RHEL-190549] - fib: allow to check if route exists in maps (Phil Sutter) [RHEL-190549] - tests: shell: Fix ifname_based_hooks feature check (Phil Sutter) [RHEL-190549] - json: reject too long interface names (Phil Sutter) [RHEL-190549] - tests/py: clean up set backend support fallout (Phil Sutter) [RHEL-190549] - cache: assert name is non-nul when looking up (Phil Sutter) [RHEL-190549] - parser_bison: only reset by name is supported by now (Phil Sutter) [RHEL-190549] - rule: skip fuzzy lookup if object name is not available (Phil Sutter) [RHEL-190549] - parser_bison: allow delete command with map via handle (Phil Sutter) [RHEL-190549] - debug: include kernel set information on cache fill (Phil Sutter) [RHEL-190549] - tests/py: prepare for set debug change (Phil Sutter) [RHEL-190549] - src: BASECHAIN flag no longer implies presence of priority expression (Phil Sutter) [RHEL-190549] - netlink: Avoid crash upon missing NFTNL_OBJ_CT_TIMEOUT_ARRAY attribute (Phil Sutter) [RHEL-190549] - tests: py: Properly fix JSON equivalents for netdev/reject.t (Phil Sutter) [RHEL-190549] - tests: shell: Adjust to ifname-based hooks (Phil Sutter) [RHEL-190549] - tests: shell: combine dormant flag with netdevice removal (Phil Sutter) [RHEL-190549] - tests: monitor: Fix for single flag array avoidance (Phil Sutter) [RHEL-190549] - netlink: Do not allocate a bogus flowtable priority expr (Phil Sutter) [RHEL-190549] - netlink: Fix for potential crash parsing a flowtable (Phil Sutter) [RHEL-190549] - json: work around fuzzer-induced assert crashes (Phil Sutter) [RHEL-190549] - json: prevent null deref if chain->policy is not set (Phil Sutter) [RHEL-190549] - tests: py: fix json single-flag output for fib & synproxy (Phil Sutter) [RHEL-190549] - tests: shell: check for features not available in 5.4 (Phil Sutter) [RHEL-190549] - netlink: Avoid potential NULL-ptr deref parsing set elem expressions (Phil Sutter) [RHEL-190549] - netlink: Catch unknown types when deserializing objects (Phil Sutter) [RHEL-190549] - json: Introduce json_add_array_new() (Phil Sutter) [RHEL-190549] - json: Fix for memleak in __binop_expr_json (Phil Sutter) [RHEL-190549] - json: Accept more than two operands in binary expressions (Phil Sutter) [RHEL-190549] - json: Print single fib flag as non-array (Phil Sutter) [RHEL-190549] - tests: shell: Add test case for JSON 'flags' arrays (Phil Sutter) [RHEL-190549] - json: Print single set flag as non-array (Phil Sutter) [RHEL-190549] - json: Print single synproxy flags as non-array (Phil Sutter) [RHEL-190549] - parser_json: Introduce parse_flags_array() (Phil Sutter) [RHEL-190549] - doc: Fix typo in nat statement 'prefix' description (Phil Sutter) [RHEL-190549] - netlink: bogus concatenated set ranges with netlink message overrun (Phil Sutter) [RHEL-190549] - parser_bison: add selector_expr rule to restrict typeof_expr (Phil Sutter) [RHEL-190549] - optimize: invalidate merge in case of duplicated key in set/map (Phil Sutter) [RHEL-190549] - evaluate: bail out if ct saddr/daddr dependency cannot be inserted (Phil Sutter) [RHEL-190549] - parser_json: bail out on malformed statement in set (Phil Sutter) [RHEL-190549] - parser_json: reject empty jump/goto chain (Phil Sutter) [RHEL-190549] - parser_json: allow statement stateful statement only in set elements (Phil Sutter) [RHEL-190549] - cache: prevent possible crash rule filter is NULL (Phil Sutter) [RHEL-190549] - optimize: expand expression list when merging into concatenation (Phil Sutter) [RHEL-190549] - cache: don't crash when filter is NULL (Phil Sutter) [RHEL-190549] - evaluate: only allow stateful statements in set and map definitions (Phil Sutter) [RHEL-190549] - evaluate: compact STMT_F_STATEFUL checks (Phil Sutter) [RHEL-190549] - json: don't BUG when asked to list synproxies (Phil Sutter) [RHEL-190549] - optimize: incorrect comparison for reject statement (Phil Sutter) [RHEL-190549] - optimize: compact bitmask matching in set/map (Phil Sutter) [RHEL-190549] - tests: shell: missing ct count elements in new set_stmt test (Phil Sutter) [RHEL-190549] - evaluate: don't update cache for anonymous chains (Phil Sutter) [RHEL-190549] - json: make sure timeout list is initialised (Phil Sutter) [RHEL-190549] - parser_bison: consolidate connlimit grammar rule for set elements (Phil Sutter) [RHEL-190549] - parser_bison: consolidate last grammar rule for set elements (Phil Sutter) [RHEL-190549] - parser_bison: consolidate quota grammar rule for set elements (Phil Sutter) [RHEL-190549] - parser_bison: consolidate limit grammar rule for set elements (Phil Sutter) [RHEL-190549] - parser_bison: consolidate counter grammar rule for set elements (Phil Sutter) [RHEL-190549] - tests: shell: extend coverage for set element statements (Phil Sutter) [RHEL-190549] - evaluate: fix assertion failure with malformed map definitions (Phil Sutter) [RHEL-190549] - evaluate: don't allow nat map with specified protocol (Phil Sutter) [RHEL-190549] - parser_bison: reject non-serializeable typeof expressions (Phil Sutter) [RHEL-190549] - netlink: fix stack buffer overrun when emitting ranged expressions (Phil Sutter) [RHEL-190549] - src: print set element with multi-word description in single one line (Phil Sutter) [RHEL-190549] - tests: shell: detach synproxy test (Phil Sutter) [RHEL-190549] - src: do not merge a set with a erroneous one (Phil Sutter) [RHEL-190549] - segtree: incomplete output in get element command with maps (Phil Sutter) [RHEL-190549] - evaluate: release existing datatype when evaluating unary expression (Phil Sutter) [RHEL-190549] - segtree: fix string data initialisation (Phil Sutter) [RHEL-190549] - payload: honor inner payload description in payload_expr_cmp() (Phil Sutter) [RHEL-190549] - payload: return early if dependency is not a payload expression (Phil Sutter) [RHEL-190549] - evaluate: optimize zero length range (Phil Sutter) [RHEL-190549] - fib: Change data type of fib oifname to "ifname" (Phil Sutter) [RHEL-190549] - evaluate: auto-merge is only available for singleton interval sets (Phil Sutter) [RHEL-190549] - parser_bison: compact and simplify list and reset syntax (Phil Sutter) [RHEL-190549] - parser_bison: turn redundant ip option type field match into boolean (Phil Sutter) [RHEL-190549] - datatype: clamp boolean value to 0 and 1 (Phil Sutter) [RHEL-190549] - tests: shell: delete netdev chain after test (Phil Sutter) [RHEL-190549] - ipopt: use ipv4 address datatype for address field in ip options (Phil Sutter) [RHEL-190549] - netlink_delinarize: fix bogus munging of mask value (Phil Sutter) [RHEL-190549] - evaluate: remove variable shadowing (Phil Sutter) [RHEL-190549] - intervals: do not merge intervals with different timeout (Phil Sutter) [RHEL-190549] - src: add EXPR_RANGE_VALUE expression and use it (Phil Sutter) [RHEL-190549] - intervals: add helper function to set previous element (Phil Sutter) [RHEL-190549] - parser_bison: fix UaF when reporting table parse error (Phil Sutter) [RHEL-190549] - intervals: set internal element location with the deletion trigger (Phil Sutter) [RHEL-190549] - optimize: compare expression length (Phil Sutter) [RHEL-190549] - tests: py: Fix for storing payload into missing file (Phil Sutter) [RHEL-190549] - json: Support typeof in set and map types (Phil Sutter) [RHEL-190549] - json: collapse set element commands from parser (Phil Sutter) [RHEL-190549] - doc: extend description of fib expression (Phil Sutter) [RHEL-190549] - tests: monitor: fix up test case breakage (Phil Sutter) [RHEL-190549] - src: fix extended netlink error reporting with large set elements (Phil Sutter) [RHEL-190549] - mnl: rename to mnl_seqnum_alloc() to mnl_seqnum_inc() (Phil Sutter) [RHEL-190549] - mnl: update cmd_add_loc() to take struct nlmsghdr (Phil Sutter) [RHEL-190549] - rule: netlink attribute offset is uint32_t for struct nlerr_loc (Phil Sutter) [RHEL-190549] - src: collapse set element commands from parser (Phil Sutter) [RHEL-190549] - libnftables-json: fix raw payload expression documentation (Phil Sutter) [RHEL-190549] - cache: initialize filter when fetching implicit chains (Phil Sutter) [RHEL-190549] - tests: py: fix up udp csum fixup output (Phil Sutter) [RHEL-190549] - proto: use NFT_PAYLOAD_L4CSUM_PSEUDOHDR flag to mangle UDP checksum (Phil Sutter) [RHEL-190549] - tests: shell: stabilize packetpath/payload (Phil Sutter) [RHEL-190549] - libnftables: Zero ctx->vars after freeing it (Phil Sutter) [RHEL-190549] - cache: position does not require full cache (Phil Sutter) [RHEL-190549] - cache: relax requirement for replace rule command (Phil Sutter) [RHEL-190549] - cache: remove full cache requirement when echo flag is set on (Phil Sutter) [RHEL-190549] - cache: assert filter when calling nft_cache_evaluate() (Phil Sutter) [RHEL-190549] - cache: consolidate reset command (Phil Sutter) [RHEL-190549] - cache: add filtering support for objects (Phil Sutter) [RHEL-190549] - cache: only dump rules for the given table (Phil Sutter) [RHEL-190549] - cache: accumulate flags in batch (Phil Sutter) [RHEL-190549] - cache: reset filter for each command (Phil Sutter) [RHEL-190549] - parser_json: fix several expression memleaks from error path (Phil Sutter) [RHEL-190549] - parser_json: release buffer returned by json_dumps (Phil Sutter) [RHEL-190549] - json: Support maps with concatenated data (Phil Sutter) [RHEL-190549] - parser_json: fix crash in json_parse_set_stmt_list (Phil Sutter) [RHEL-190549] - parser_bison: allow 0 burst in limit rate byte mode (Phil Sutter) [RHEL-190549] - datatype: improve error reporting when time unit is not correct (Phil Sutter) [RHEL-190549] - cache: rule by index requires full cache (Phil Sutter) [RHEL-190549] - datatype: reject rate in quota statement (Phil Sutter) [RHEL-190549] - optimize: skip variables in nat statements (Phil Sutter) [RHEL-190549] - parser_json: use stdin buffer if available (Phil Sutter) [RHEL-190549] - libnftables: skip useable checks for /dev/stdin (Phil Sutter) [RHEL-190549] - optimize: clone counter before insertion into set element (Phil Sutter) [RHEL-190549] - segtree: set on EXPR_F_KERNEL flag for catchall elements in the cache (Phil Sutter) [RHEL-190549] - evaluate: set on expr->len for catchall set elements (Phil Sutter) [RHEL-190549] - parser_bison: recursive table declaration in deprecated meter statement (Phil Sutter) [RHEL-190549] - intervals: fix element deletions with maps (Phil Sutter) [RHEL-190549] - src: add string preprocessor and use it for log prefix string (Phil Sutter) [RHEL-190549] - tests: shell: skip ip option tests if kernel does not support it (Phil Sutter) [RHEL-190549] - cmd: skip variable set elements when collapsing commands (Phil Sutter) [RHEL-190549] - cmd: provide better hint if chain is already declared with different type/hook/priority (Phil Sutter) [RHEL-190549] - monitor: too large shift exponent displaying payload expression (Phil Sutter) [RHEL-190549] - scanner: inet_pton() allows for broader IPv4-Mapped IPv6 addresses (Phil Sutter) [RHEL-190549] - evaluate: Fix incorrect checking the `base` variable in case of IPV6 (Phil Sutter) [RHEL-190549] - evaluate: bogus protocol conflicts in vlan with implicit dependencies (Phil Sutter) [RHEL-190549] - cache: check for NFT_CACHE_REFRESH in current requested cache too (Phil Sutter) [RHEL-190549] - doc: nft.8: Fix markup in ct expectation synopsis (Phil Sutter) [RHEL-190549] - mergesort: Avoid accidental set element reordering (Phil Sutter) [RHEL-190549] - doc: nft.8: Two minor synopsis fixups (Phil Sutter) [RHEL-190549] - tests: shell: check for reset tcp options support (Phil Sutter) [RHEL-190549] - tests: shell: payload matching requires egress support (Phil Sutter) [RHEL-190549] - tests: py: complete icmp and icmpv6 update (Phil Sutter) [RHEL-190549] - src: disentangle ICMP code types (Phil Sutter) [RHEL-190549] - evaluate: display "Range negative size" error (Phil Sutter) [RHEL-190549] - netlink_delinearize: restore binop syntax when listing ruleset for flags (Phil Sutter) [RHEL-190549] - doc: libnftables-json: Drop invalid ops from match expression (Phil Sutter) [RHEL-190549] - parser: json: Support for synproxy objects (Phil Sutter) [RHEL-190549] - tests: py: add payload merging test cases (Phil Sutter) [RHEL-190549] - nftables: do mot merge payloads on negation (Phil Sutter) [RHEL-190549] - rule: fix ASAN errors in chain priority to textual names (Phil Sutter) [RHEL-190549] - parser: compact type/typeof set rules (Phil Sutter) [RHEL-190549] - parser: compact interval typeof rules (Phil Sutter) [RHEL-190549] - src: improve error reporting for destroy command (Phil Sutter) [RHEL-190549] - tests: shell: permit use of host-endian constant values in set lookup keys (Phil Sutter) [RHEL-190549] - evaluate: permit use of host-endian constant values in set lookup keys (Phil Sutter) [RHEL-190549] - expression: missing line in describe command with invalid expression (Phil Sutter) [RHEL-190549] - netlink_delinearize: move concat and value postprocessing to helpers (Phil Sutter) [RHEL-190549] - evaluate: skip byteorder conversion for selector smaller than 2 bytes (Phil Sutter) [RHEL-190549] - cache: Optimize caching for 'list tables' command (Phil Sutter) [RHEL-190549] - evaluate: fix check for unknown in cmd_op_to_name (Phil Sutter) [RHEL-190549] - evaluate: don't assert on net/transport header conflict (Phil Sutter) [RHEL-190549] - json: Support sets' auto-merge option (Phil Sutter) [RHEL-190549] - rule: fix sym refcount assertion (Phil Sutter) [RHEL-190549] - evaluate: error out when store needs more than one 128bit register of align fixup (Phil Sutter) [RHEL-190549] - evaluate: do not fetch next expression on runaway number of concatenation components (Phil Sutter) [RHEL-190549] - evaluate: skip anonymous set optimization for concatenations (Phil Sutter) [RHEL-190549] - evaluate: add missing range checks for dup,fwd and payload statements (Phil Sutter) [RHEL-190549] - doc: incorrect datatype description for icmpv6_type and icmpvx_code (Phil Sutter) [RHEL-190549] - tests: shell: prefer project nft to system-wide nft (Phil Sutter) [RHEL-190549] - parser_bison: ensure all timeout policy names are released (Phil Sutter) [RHEL-190549] - netlink: fix stack overflow due to erroneous rounding (Phil Sutter) [RHEL-190549] - parser_bison: error out on duplicated type/typeof/element keywords (Phil Sutter) [RHEL-190549] - tests: shell: add test to cover payload transport match and mangle (Phil Sutter) [RHEL-190549] - evaluate: fix stack overflow with huge priority string (Phil Sutter) [RHEL-190549] - src: reject large raw payload and concat expressions (Phil Sutter) [RHEL-190549] - evaluate: exthdr: statement arg must be not be a range (Phil Sutter) [RHEL-190549] - meta: fix tc classid parsing out-of-bounds access (Phil Sutter) [RHEL-190549] - parser_bison: close chain scope before chain release (Phil Sutter) [RHEL-190549] - evaluate: fix bogus assertion failure with boolean datatype (Phil Sutter) [RHEL-190549] - parser_bison: fix objref statement corruption (Phil Sutter) [RHEL-190549] - tests: py: missing json output in meta.t with vlan mapping (Phil Sutter) [RHEL-190549] - evaluate: reset statement length context before evaluating statement (Phil Sutter) [RHEL-190549] - parser: tcpopt: fix tcp option parsing with NUM + length field (Phil Sutter) [RHEL-190549] - evaluate: reject set definition with no key (Phil Sutter) [RHEL-190549] - monitor: add support for concatenated set ranges (Phil Sutter) [RHEL-190549] - evaluate: disable meta set with ranges (Phil Sutter) [RHEL-190549] - evaluate: prevent assert when evaluating very large shift values (Phil Sutter) [RHEL-190549] - evaluate: reject sets with no key (Phil Sutter) [RHEL-190549] - evaluate: clone unary expression datatype to deal with dynamic datatype (Phil Sutter) [RHEL-190549] - tests: shell: split nat inet tests (Phil Sutter) [RHEL-190549] - evaluate: bogus error when adding devices to flowtable (Phil Sutter) [RHEL-190549] - tests: shell: flush connlimit sets (Phil Sutter) [RHEL-190549] - tests: shell: adjust add-after-delete flowtable for older kernels (Phil Sutter) [RHEL-190549] - evaluate: fix rule replacement with anon sets (Phil Sutter) [RHEL-190549] - tests: shell: skip if kernel does not support flowtable counter (Phil Sutter) [RHEL-190549] - tests: shell: restore pipapo and chain binding coverage in standalone 30s-stress (Phil Sutter) [RHEL-190549] - json: fix use after free in table_flags_json() (Phil Sutter) [RHEL-190549] - src: expand create commands (Phil Sutter) [RHEL-190549] - tests: shell: split set NAT interval test (Phil Sutter) [RHEL-190549] - tests: shell: split merge nat optimization in two tests (Phil Sutter) [RHEL-190549] - netlink: fix buffer size for user data in netlink_delinearize_chain() (Phil Sutter) [RHEL-190549] - src: remove xfree() and use plain free() (Phil Sutter) [RHEL-190549] - src: add free_const() and use it instead of xfree() (Phil Sutter) [RHEL-190549] - evaluate: place byteorder conversion before rshift in payload expressions (Phil Sutter) [RHEL-190549] - evaluate: reset statement length context only for set mappings (Phil Sutter) [RHEL-190549] - meta: fix hour decoding when timezone offset is negative (Phil Sutter) [RHEL-190549] - tproxy: Drop artificial port printing restriction (Phil Sutter) [RHEL-190549] - tests/shell: fix mount command in "test-wrapper.sh" (Phil Sutter) [RHEL-190549] - parser_bison: fix length check for ifname in ifname_expr_alloc() (Phil Sutter) [RHEL-190549] - tests/shell: cover long interface name in "0042chain_variable_0" test (Phil Sutter) [RHEL-190549] - tests/shell: add missing "elem_opts_compat_0.nodump" file (Phil Sutter) [RHEL-190549] - parser_bison: Fix for broken compatibility with older dumps (Phil Sutter) [RHEL-190549] - src: fix reset element support for interval set type (Phil Sutter) [RHEL-153461] - src: netlink: fix crash when ops doesn't support udata (Phil Sutter) [RHEL-153461] - Revert doc/ part of "exthdr: add boolean DCCP option matching" (Phil Sutter) [RHEL-126817] - Revert doc/ part of "meta: introduce meta broute support" (Phil Sutter) [RHEL-126817] - Revert doc/ part of "src: add tcp option reset support" (Phil Sutter) [RHEL-126817] - spec: Update expected test suite results (Phil Sutter) [RHEL-126817] - tests: py: missing json output in never merge across non-expression statements (Phil Sutter) [RHEL-114095] - tests: py: add missing json.output data (Phil Sutter) [RHEL-114095] - tests: py: remove huge-limit test cases (Phil Sutter) [RHEL-114095] - datatype: rt_symbol_table_init() to search for iproute2 configs (Phil Sutter) [RHEL-114095] - tests: shell: connect chains to hook point (Phil Sutter) [RHEL-114095] - tests: shell: Fix sets/reset_command_0 for current kernels (Phil Sutter) [RHEL-114095] - parser_json: fix handle memleak from error path (Phil Sutter) [RHEL-88181] - json: deal appropriately with multidevice in chain (Phil Sutter) [RHEL-88181] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - rebase to v2.0.19 - rebase to v2.0.18 - fix typo in memhog.8 - Dummy release to get s390x binary in errata - rebase to v2.0.19 - rebase to v2.0.18 - fix typo in memhog.8 - Dummy release to get s390x binary in errata - recognize the -m option (RHEL-16571) - Update to version 2.16 (RHEL-129947) - Update to version 2.13 - Fix for RHEL-10433 - Add kernel-headers to BuildRequires (RHEL-70856) - NetApp fixes for RHEL-71521 - Rebuild for RHEL-67144 - Update to version v2.11 RHEL-67144 - Update to version 2.10.2 RHEL-60536 - Install NetworkManager override for nbft interfaces - Rename reconnect NetworkManager hook to 99-nvme-nbft-connect.sh - Fix RHEL-38372 - Adding gating tests - Rebuild for RHEL-58733 - Update to version 0.8 - Fix memory leaks, initialize memory Resolves: RHEL-31794 - Enable LTO Resolves: #1990100 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 6.9.6 - 6.9.6 rc4 - Apply upstream patch for upstream bug 221 - Revert change for false CVE-2020-26159 issue https://github.com/kkos/oniguruma/issues/221 - 6.9.6 rc3 - 6.9.6 rc2 - Apply upstream patch to keep binary compatibility with 6.9.5 - Resolves: RHEL-144821, CVE-2026-23893 - Resolves: RHEL-75139, ep11 token BLS support - Resolves: RHEL-85381, ep11 token: ML-KEM and ML-DSA support - Resolves: RHEL-85384. cca token: ML-KEM and ML-DSA support - Resolves: RHEL-100059, openCryptoki 3.26.0 - Fix pkcsslotd fails to start in FIPS - Drop tier1 test as it mostly provides duplicate results - Enable ci test for FIPS mode Resolves: RHEL-109050 - Fix incorrect effective group id of pkcsslotd daemon - Fix covscan findings Resolves: RHEL-104602 - Related: RHEL-73344, Fix detection of EC curve not supported by OpenSSL-3.5.x - Related: RHEL-77147, Fix the image mode issue again as bootc expects to use /run/lock - Resolves: RHEL-73344, upgrade openCryptoki - Resolves: RHEL-90590, basic support of AES-GCM - Resolves: RHEL-72965, cca token support cipher keys - Resolves: RHEL-72969, support for CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens - Resolves: RHEL-75141, add a tool to import/export PKCS #11 keys from to a KMIP server - Resolves: RHEL-75762, ep11 token: import and export of secure key objects - Resolves: RHEL-85375, cca token: Support ECDH to derive AES keys - Resolves: RHEL-85377, ep11 token: PKCS #11 3.0 - support SHA3 - Related: RHEL-77147, opencryptoki doesn't work in image mode - Resolves: RHEL-77147, opencryptoki doesn't work in image mode - Disable ccatok on aarch64 Related: RHEL-50064 - Fix resource leak Related: RHEL-50064 - Resolves: RHEL-171562, Fix CVE-2026-40253, possible out-of-bounds access in BER decode functions - Resolves: RHEL-169586, Fix syslog message printing about different CPs - Resolves: RHEL-144821, CVE-2026-23893 - Resolves: RHEL-75139, ep11 token BLS support - Resolves: RHEL-85381, ep11 token: ML-KEM and ML-DSA support - Resolves: RHEL-85384. cca token: ML-KEM and ML-DSA support - Resolves: RHEL-100059, openCryptoki 3.26.0 - Fix pkcsslotd fails to start in FIPS - Drop tier1 test as it mostly provides duplicate results - Enable ci test for FIPS mode Resolves: RHEL-109050 - Fix incorrect effective group id of pkcsslotd daemon - Fix covscan findings Resolves: RHEL-104602 - Related: RHEL-73344, Fix detection of EC curve not supported by OpenSSL-3.5.x - Related: RHEL-77147, Fix the image mode issue again as bootc expects to use /run/lock - Resolves: RHEL-73344, upgrade openCryptoki - Resolves: RHEL-90590, basic support of AES-GCM - Resolves: RHEL-72965, cca token support cipher keys - Resolves: RHEL-72969, support for CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens - Resolves: RHEL-75141, add a tool to import/export PKCS #11 keys from to a KMIP server - Resolves: RHEL-75762, ep11 token: import and export of secure key objects - Resolves: RHEL-85375, cca token: Support ECDH to derive AES keys - Resolves: RHEL-85377, ep11 token: PKCS #11 3.0 - support SHA3 - Related: RHEL-77147, opencryptoki doesn't work in image mode - Resolves: RHEL-77147, opencryptoki doesn't work in image mode - Resolves: RHEL-144821, CVE-2026-23893 - Resolves: RHEL-75139, ep11 token BLS support - Resolves: RHEL-85381, ep11 token: ML-KEM and ML-DSA support - Resolves: RHEL-85384. cca token: ML-KEM and ML-DSA support - Resolves: RHEL-100059, openCryptoki 3.26.0 - Fix pkcsslotd fails to start in FIPS - Drop tier1 test as it mostly provides duplicate results - Enable ci test for FIPS mode Resolves: RHEL-109050 - Fix incorrect effective group id of pkcsslotd daemon - Fix covscan findings Resolves: RHEL-104602 - Related: RHEL-73344, Fix detection of EC curve not supported by OpenSSL-3.5.x - Related: RHEL-77147, Fix the image mode issue again as bootc expects to use /run/lock - Resolves: RHEL-73344, upgrade openCryptoki - Resolves: RHEL-90590, basic support of AES-GCM - Resolves: RHEL-72965, cca token support cipher keys - Resolves: RHEL-72969, support for CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens - Resolves: RHEL-75141, add a tool to import/export PKCS #11 keys from to a KMIP server - Resolves: RHEL-75762, ep11 token: import and export of secure key objects - Resolves: RHEL-85375, cca token: Support ECDH to derive AES keys - Resolves: RHEL-85377, ep11 token: PKCS #11 3.0 - support SHA3 - Related: RHEL-77147, opencryptoki doesn't work in image mode - Resolves: RHEL-77147, opencryptoki doesn't work in image mode - Disable ccatok on aarch64 Related: RHEL-50064 - Fix resource leak Related: RHEL-50064 - Resolves: RHEL-171562, Fix CVE-2026-40253, possible out-of-bounds access in BER decode functions - Resolves: RHEL-169586, Fix syslog message printing about different CPs - Resolves: RHEL-144821, CVE-2026-23893 - Resolves: RHEL-75139, ep11 token BLS support - Resolves: RHEL-85381, ep11 token: ML-KEM and ML-DSA support - Resolves: RHEL-85384. cca token: ML-KEM and ML-DSA support - Resolves: RHEL-100059, openCryptoki 3.26.0 - Fix pkcsslotd fails to start in FIPS - Drop tier1 test as it mostly provides duplicate results - Enable ci test for FIPS mode Resolves: RHEL-109050 - Fix incorrect effective group id of pkcsslotd daemon - Fix covscan findings Resolves: RHEL-104602 - Related: RHEL-73344, Fix detection of EC curve not supported by OpenSSL-3.5.x - Related: RHEL-77147, Fix the image mode issue again as bootc expects to use /run/lock - Resolves: RHEL-73344, upgrade openCryptoki - Resolves: RHEL-90590, basic support of AES-GCM - Resolves: RHEL-72965, cca token support cipher keys - Resolves: RHEL-72969, support for CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens - Resolves: RHEL-75141, add a tool to import/export PKCS #11 keys from to a KMIP server - Resolves: RHEL-75762, ep11 token: import and export of secure key objects - Resolves: RHEL-85375, cca token: Support ECDH to derive AES keys - Resolves: RHEL-85377, ep11 token: PKCS #11 3.0 - support SHA3 - Related: RHEL-77147, opencryptoki doesn't work in image mode - Resolves: RHEL-77147, opencryptoki doesn't work in image mode - Resolves: RHEL-144821, CVE-2026-23893 - Resolves: RHEL-75139, ep11 token BLS support - Resolves: RHEL-85381, ep11 token: ML-KEM and ML-DSA support - Resolves: RHEL-85384. cca token: ML-KEM and ML-DSA support - Resolves: RHEL-100059, openCryptoki 3.26.0 - Fix pkcsslotd fails to start in FIPS - Drop tier1 test as it mostly provides duplicate results - Enable ci test for FIPS mode Resolves: RHEL-109050 - Fix incorrect effective group id of pkcsslotd daemon - Fix covscan findings Resolves: RHEL-104602 - Related: RHEL-73344, Fix detection of EC curve not supported by OpenSSL-3.5.x - Related: RHEL-77147, Fix the image mode issue again as bootc expects to use /run/lock - Resolves: RHEL-73344, upgrade openCryptoki - Resolves: RHEL-90590, basic support of AES-GCM - Resolves: RHEL-72965, cca token support cipher keys - Resolves: RHEL-72969, support for CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens - Resolves: RHEL-75141, add a tool to import/export PKCS #11 keys from to a KMIP server - Resolves: RHEL-75762, ep11 token: import and export of secure key objects - Resolves: RHEL-85375, cca token: Support ECDH to derive AES keys - Resolves: RHEL-85377, ep11 token: PKCS #11 3.0 - support SHA3 - Related: RHEL-77147, opencryptoki doesn't work in image mode - Resolves: RHEL-77147, opencryptoki doesn't work in image mode - Disable ccatok on aarch64 Related: RHEL-50064 - Fix resource leak Related: RHEL-50064 - Resolves: RHEL-171562, Fix CVE-2026-40253, possible out-of-bounds access in BER decode functions - Resolves: RHEL-169586, Fix syslog message printing about different CPs - Resolves: RHEL-144821, CVE-2026-23893 - Resolves: RHEL-75139, ep11 token BLS support - Resolves: RHEL-85381, ep11 token: ML-KEM and ML-DSA support - Resolves: RHEL-85384. cca token: ML-KEM and ML-DSA support - Resolves: RHEL-100059, openCryptoki 3.26.0 - Fix pkcsslotd fails to start in FIPS - Drop tier1 test as it mostly provides duplicate results - Enable ci test for FIPS mode Resolves: RHEL-109050 - Fix incorrect effective group id of pkcsslotd daemon - Fix covscan findings Resolves: RHEL-104602 - Related: RHEL-73344, Fix detection of EC curve not supported by OpenSSL-3.5.x - Related: RHEL-77147, Fix the image mode issue again as bootc expects to use /run/lock - Resolves: RHEL-73344, upgrade openCryptoki - Resolves: RHEL-90590, basic support of AES-GCM - Resolves: RHEL-72965, cca token support cipher keys - Resolves: RHEL-72969, support for CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens - Resolves: RHEL-75141, add a tool to import/export PKCS #11 keys from to a KMIP server - Resolves: RHEL-75762, ep11 token: import and export of secure key objects - Resolves: RHEL-85375, cca token: Support ECDH to derive AES keys - Resolves: RHEL-85377, ep11 token: PKCS #11 3.0 - support SHA3 - Related: RHEL-77147, opencryptoki doesn't work in image mode - Resolves: RHEL-77147, opencryptoki doesn't work in image mode - Resolves: RHEL-144821, CVE-2026-23893 - Resolves: RHEL-75139, ep11 token BLS support - Resolves: RHEL-85381, ep11 token: ML-KEM and ML-DSA support - Resolves: RHEL-85384. cca token: ML-KEM and ML-DSA support - Resolves: RHEL-100059, openCryptoki 3.26.0 - Fix pkcsslotd fails to start in FIPS - Drop tier1 test as it mostly provides duplicate results - Enable ci test for FIPS mode Resolves: RHEL-109050 - Fix incorrect effective group id of pkcsslotd daemon - Fix covscan findings Resolves: RHEL-104602 - Related: RHEL-73344, Fix detection of EC curve not supported by OpenSSL-3.5.x - Related: RHEL-77147, Fix the image mode issue again as bootc expects to use /run/lock - Resolves: RHEL-73344, upgrade openCryptoki - Resolves: RHEL-90590, basic support of AES-GCM - Resolves: RHEL-72965, cca token support cipher keys - Resolves: RHEL-72969, support for CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens - Resolves: RHEL-75141, add a tool to import/export PKCS #11 keys from to a KMIP server - Resolves: RHEL-75762, ep11 token: import and export of secure key objects - Resolves: RHEL-85375, cca token: Support ECDH to derive AES keys - Resolves: RHEL-85377, ep11 token: PKCS #11 3.0 - support SHA3 - Related: RHEL-77147, opencryptoki doesn't work in image mode - Resolves: RHEL-77147, opencryptoki doesn't work in image mode - Disable ccatok on aarch64 Related: RHEL-50064 - Fix resource leak Related: RHEL-50064 - Resolves: RHEL-171562, Fix CVE-2026-40253, possible out-of-bounds access in BER decode functions - Resolves: RHEL-169586, Fix syslog message printing about different CPs - Resolves: RHEL-144821, CVE-2026-23893 - Resolves: RHEL-75139, ep11 token BLS support - Resolves: RHEL-85381, ep11 token: ML-KEM and ML-DSA support - Resolves: RHEL-85384. cca token: ML-KEM and ML-DSA support - Resolves: RHEL-100059, openCryptoki 3.26.0 - Fix pkcsslotd fails to start in FIPS - Drop tier1 test as it mostly provides duplicate results - Enable ci test for FIPS mode Resolves: RHEL-109050 - Fix incorrect effective group id of pkcsslotd daemon - Fix covscan findings Resolves: RHEL-104602 - Related: RHEL-73344, Fix detection of EC curve not supported by OpenSSL-3.5.x - Related: RHEL-77147, Fix the image mode issue again as bootc expects to use /run/lock - Resolves: RHEL-73344, upgrade openCryptoki - Resolves: RHEL-90590, basic support of AES-GCM - Resolves: RHEL-72965, cca token support cipher keys - Resolves: RHEL-72969, support for CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens - Resolves: RHEL-75141, add a tool to import/export PKCS #11 keys from to a KMIP server - Resolves: RHEL-75762, ep11 token: import and export of secure key objects - Resolves: RHEL-85375, cca token: Support ECDH to derive AES keys - Resolves: RHEL-85377, ep11 token: PKCS #11 3.0 - support SHA3 - Related: RHEL-77147, opencryptoki doesn't work in image mode - Resolves: RHEL-77147, opencryptoki doesn't work in image mode - Fix TLS connection timeout handling (RHEL-78297) - Migrate gating tests from STI to FMF (RHEL-71053) - Replace baseos-ci tests with osci (RHEL-71053) - Rebase to version 2.6.8 (RHEL-71053) - Avoid SSL context cleanup during library destruction (RHEL-56502) - Disable MD2 hash algorithm Resolves: RHEL-59715 - Use systemd-sysusers for ldap user and group Replace License with SPDX identifier Resolves: RHEL-5140 - The client tools parameters '-h' and '-p' are still deprecated, but this release brings back the client tools options that were removed during the previous rebase. Resolves: RHEL-19384 - Rebase OpenLDAP in RHEL 9.4 Resolves: RHEL-11306 - Rebase OpenLDAP to 2.6.3 Related: rhbz#2212983 - Fix TLS connection timeout handling (RHEL-78297) - Migrate gating tests from STI to FMF (RHEL-71053) - Replace baseos-ci tests with osci (RHEL-71053) - Rebase to version 2.6.8 (RHEL-71053) - Avoid SSL context cleanup during library destruction (RHEL-56502) - Disable MD2 hash algorithm Resolves: RHEL-59715 - Use systemd-sysusers for ldap user and group Replace License with SPDX identifier Resolves: RHEL-5140 - The client tools parameters '-h' and '-p' are still deprecated, but this release brings back the client tools options that were removed during the previous rebase. Resolves: RHEL-19384 - Rebase OpenLDAP in RHEL 9.4 Resolves: RHEL-11306 - Rebase OpenLDAP to 2.6.3 Related: rhbz#2212983 - Fix TLS connection timeout handling (RHEL-78297) - Migrate gating tests from STI to FMF (RHEL-71053) - Replace baseos-ci tests with osci (RHEL-71053) - Rebase to version 2.6.8 (RHEL-71053) - Avoid SSL context cleanup during library destruction (RHEL-56502) - Disable MD2 hash algorithm Resolves: RHEL-59715 - Use systemd-sysusers for ldap user and group Replace License with SPDX identifier Resolves: RHEL-5140 - The client tools parameters '-h' and '-p' are still deprecated, but this release brings back the client tools options that were removed during the previous rebase. Resolves: RHEL-19384 - Rebase OpenLDAP in RHEL 9.4 Resolves: RHEL-11306 - Rebase OpenLDAP to 2.6.3 Related: rhbz#2212983 - Fix free before dereference when reading public key (RHEL-96029) - Add URI in PKCS#11 objects and pkcs11-tool (RHEL-53115) - Fix CVE-2023-5992: Side-channel leaks while stripping encryption PKCS#1.5 padding - Fix file caching with different offsets (RHEL-4079) - Fix CVE-2023-40660: Potential PIN bypass - Fix CVE-2023-40661: Dynamic analyzers reports in pkcs15init - Fix CVE-2023-4535: Out-of-bounds read in MyEID driver handling encryption using symmetric keys - Fix CVE-2023-5992: Side-channel leaks while stripping encryption PKCS#1.5 padding - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebase opensm to latest upstream release 3.3.24 - Resolves: bz1961963 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use make macros https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make - opensm service should after rdma-hw.target - Update systemd service file - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebase opensm to latest upstream release 3.3.23 - Resolves: bz1813779 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebase opensm to latest upstream release 3.3.24 - Resolves: bz1961963 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use make macros https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make - opensm service should after rdma-hw.target - Update systemd service file - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebase opensm to latest upstream release 3.3.23 - Resolves: bz1813779 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Unpatch Red Hat help message - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245416 - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245424 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245419 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded file location Resolves: RHEL-236320 - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-236286 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Enable support for DSA keys Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-133960 - Unpatch Red Hat help message - CVE-2026-60001: Fix cases in GSSAPI and keyboard-interactive authentication where the minimum per-attempt delay was not being enforced Resolves: RHEL-258461 - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245416 - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245424 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245419 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded file location Resolves: RHEL-236320 - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-236286 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Unpatch Red Hat help message - CVE-2026-59998: Document caveat regarding GSSAPIStrictAcceptorCheck Resolves: RHEL-276221 - CVE-2026-59997: Fix internal-sftp server argument parsing limit Resolves: RHEL-276234 - CVE-2026-60000: Fix DoS via excessive GSSAPI authentication attempts Resolves: RHEL-276230 - CVE-2026-60001: Fix cases in GSSAPI and keyboard-interactive authentication where the minimum per-attempt delay was not being enforced Resolves: RHEL-258461 - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245416 - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245424 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245419 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded file location Resolves: RHEL-236320 - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-236286 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Unpatch Red Hat help message - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Enable support for DSA keys Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-133960 - Fix implicit destination path selection when source path ends with ".." Resolves: RHEL-119515 - Canonicalize username when matching a user Resolves: RHEL-118372 - Rebase to version 9.9 Resolves: RHEL-108912 - Move the redhat help message to debug1 log level Resolves: RHEL-104580 - Fix missing error codes set and invalid error code checks in OpenSSH. It prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS is on (CVE-2025-26465). Resolves: RHEL-78700 - Unpatch Red Hat help message - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Enable support for DSA keys Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-133960 - Fix implicit destination path selection when source path ends with ".." Resolves: RHEL-119515 - Canonicalize username when matching a user Resolves: RHEL-118372 - Rebase to version 9.9 Resolves: RHEL-108912 - Unpatch Red Hat help message - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245416 - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245424 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245419 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded file location Resolves: RHEL-236320 - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-236286 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Enable support for DSA keys Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-133960 - Unpatch Red Hat help message - CVE-2026-60001: Fix cases in GSSAPI and keyboard-interactive authentication where the minimum per-attempt delay was not being enforced Resolves: RHEL-258461 - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245416 - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245424 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245419 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded file location Resolves: RHEL-236320 - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-236286 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Unpatch Red Hat help message - CVE-2026-59998: Document caveat regarding GSSAPIStrictAcceptorCheck Resolves: RHEL-276221 - CVE-2026-59997: Fix internal-sftp server argument parsing limit Resolves: RHEL-276234 - CVE-2026-60000: Fix DoS via excessive GSSAPI authentication attempts Resolves: RHEL-276230 - CVE-2026-60001: Fix cases in GSSAPI and keyboard-interactive authentication where the minimum per-attempt delay was not being enforced Resolves: RHEL-258461 - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245416 - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245424 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245419 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded file location Resolves: RHEL-236320 - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-236286 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Unpatch Red Hat help message - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Enable support for DSA keys Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-133960 - Fix implicit destination path selection when source path ends with ".." Resolves: RHEL-119515 - Canonicalize username when matching a user Resolves: RHEL-118372 - Rebase to version 9.9 Resolves: RHEL-108912 - Move the redhat help message to debug1 log level Resolves: RHEL-104580 - Fix missing error codes set and invalid error code checks in OpenSSH. It prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS is on (CVE-2025-26465). Resolves: RHEL-78700 - Unpatch Red Hat help message - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Enable support for DSA keys Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-133960 - Fix implicit destination path selection when source path ends with ".." Resolves: RHEL-119515 - Canonicalize username when matching a user Resolves: RHEL-118372 - Rebase to version 9.9 Resolves: RHEL-108912 - Unpatch Red Hat help message - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245416 - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245424 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245419 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded file location Resolves: RHEL-236320 - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-236286 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Enable support for DSA keys Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-133960 - Unpatch Red Hat help message - CVE-2026-60001: Fix cases in GSSAPI and keyboard-interactive authentication where the minimum per-attempt delay was not being enforced Resolves: RHEL-258461 - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245416 - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245424 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245419 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded file location Resolves: RHEL-236320 - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-236286 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Unpatch Red Hat help message - CVE-2026-59998: Document caveat regarding GSSAPIStrictAcceptorCheck Resolves: RHEL-276221 - CVE-2026-59997: Fix internal-sftp server argument parsing limit Resolves: RHEL-276234 - CVE-2026-60000: Fix DoS via excessive GSSAPI authentication attempts Resolves: RHEL-276230 - CVE-2026-60001: Fix cases in GSSAPI and keyboard-interactive authentication where the minimum per-attempt delay was not being enforced Resolves: RHEL-258461 - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245416 - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245424 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245419 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded file location Resolves: RHEL-236320 - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-236286 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Unpatch Red Hat help message - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Enable support for DSA keys Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-133960 - Fix implicit destination path selection when source path ends with ".." Resolves: RHEL-119515 - Canonicalize username when matching a user Resolves: RHEL-118372 - Rebase to version 9.9 Resolves: RHEL-108912 - Move the redhat help message to debug1 log level Resolves: RHEL-104580 - Fix missing error codes set and invalid error code checks in OpenSSH. It prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS is on (CVE-2025-26465). Resolves: RHEL-78700 - Unpatch Red Hat help message - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Enable support for DSA keys Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-133960 - Fix implicit destination path selection when source path ends with ".." Resolves: RHEL-119515 - Canonicalize username when matching a user Resolves: RHEL-118372 - Rebase to version 9.9 Resolves: RHEL-108912 - Unpatch Red Hat help message - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245416 - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245424 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245419 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded file location Resolves: RHEL-236320 - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-236286 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Enable support for DSA keys Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-133960 - Unpatch Red Hat help message - CVE-2026-60001: Fix cases in GSSAPI and keyboard-interactive authentication where the minimum per-attempt delay was not being enforced Resolves: RHEL-258461 - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245416 - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245424 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245419 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded file location Resolves: RHEL-236320 - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-236286 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Unpatch Red Hat help message - CVE-2026-59998: Document caveat regarding GSSAPIStrictAcceptorCheck Resolves: RHEL-276221 - CVE-2026-59997: Fix internal-sftp server argument parsing limit Resolves: RHEL-276234 - CVE-2026-60000: Fix DoS via excessive GSSAPI authentication attempts Resolves: RHEL-276230 - CVE-2026-60001: Fix cases in GSSAPI and keyboard-interactive authentication where the minimum per-attempt delay was not being enforced Resolves: RHEL-258461 - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245416 - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245424 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245419 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded file location Resolves: RHEL-236320 - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-236286 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Unpatch Red Hat help message - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Enable support for DSA keys Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-133960 - Fix implicit destination path selection when source path ends with ".." Resolves: RHEL-119515 - Canonicalize username when matching a user Resolves: RHEL-118372 - Rebase to version 9.9 Resolves: RHEL-108912 - Move the redhat help message to debug1 log level Resolves: RHEL-104580 - Fix missing error codes set and invalid error code checks in OpenSSH. It prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS is on (CVE-2025-26465). Resolves: RHEL-78700 - Unpatch Red Hat help message - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Enable support for DSA keys Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-133960 - Fix implicit destination path selection when source path ends with ".." Resolves: RHEL-119515 - Canonicalize username when matching a user Resolves: RHEL-118372 - Rebase to version 9.9 Resolves: RHEL-108912 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix globally disabled LTO Related: RHEL-111633 - Make openssl speed test signatures without errors Resolves: RHEL-95502 - Build tests in check and without LTO Resolves: RHEL-111633 - Add custom define to disable symbol versioning in downstream patched code Also add stricter Suggests for openssl-fips-provider Resolves: RHEL-104236 - Fix Requires/Provider to fix default install of fips providers Resolves: RHEL-104856 - Move fips.so to a seprate subpackage Reverts FIPS self test for SLH-DSA Add Suggests to try to prefer the openssl-fips-provider package over the fips-provider-next package by default Revolves: RHEL-102408 Related: RHEL-80854 - Rebasing to OpenSSL 3.5.1 Resolves: RHEL-97797 Resolves: RHEL-98723 Resolves: RHEL-99352 - Compact patches for better maintainability Related: RHEL-80854 - Make hybrid MLKEM work with our FIPS provider (3.0.7) Resolves: RHEL-95239 - Fix regressions caused by rebase to OpenSSL 3.5 Related: RHEL-80854 - Fix CVE-2026-28390 Resolves: RHEL-165870 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix globally disabled LTO Related: RHEL-111633 - Make openssl speed test signatures without errors Resolves: RHEL-95502 - Build tests in check and without LTO Resolves: RHEL-111633 - Add custom define to disable symbol versioning in downstream patched code Also add stricter Suggests for openssl-fips-provider Resolves: RHEL-104236 - Fix Requires/Provider to fix default install of fips providers Resolves: RHEL-104856 - Move fips.so to a seprate subpackage Reverts FIPS self test for SLH-DSA Add Suggests to try to prefer the openssl-fips-provider package over the fips-provider-next package by default Revolves: RHEL-102408 Related: RHEL-80854 - Rebasing to OpenSSL 3.5.1 Resolves: RHEL-97797 Resolves: RHEL-98723 Resolves: RHEL-99352 - Compact patches for better maintainability Related: RHEL-80854 - Make hybrid MLKEM work with our FIPS provider (3.0.7) Resolves: RHEL-95239 Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves: RHEL-179274 Resolves: RHEL-179287 Resolves: RHEL-179539 Resolves: RHEL-179544 Resolves: RHEL-179547 Resolves: RHEL-179552 Resolves: RHEL-179556 Resolves: RHEL-179633 Resolves: RHEL-179661 Resolves: RHEL-179678 Resolves: RHEL-179684 Resolves: RHEL-179688 Resolves: RHEL-179691 Resolves: RHEL-179696 Resolves: RHEL-179699 - Fix CVE-2026-28390 Resolves: RHEL-165870 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix globally disabled LTO Related: RHEL-111633 - Make openssl speed test signatures without errors Resolves: RHEL-95502 - Build tests in check and without LTO Resolves: RHEL-111633 - Add custom define to disable symbol versioning in downstream patched code Also add stricter Suggests for openssl-fips-provider Resolves: RHEL-104236 - Fix Requires/Provider to fix default install of fips providers Resolves: RHEL-104856 - Move fips.so to a seprate subpackage Reverts FIPS self test for SLH-DSA Add Suggests to try to prefer the openssl-fips-provider package over the fips-provider-next package by default Revolves: RHEL-102408 Related: RHEL-80854 - Rebasing to OpenSSL 3.5.1 Resolves: RHEL-97797 Resolves: RHEL-98723 Resolves: RHEL-99352 - Patch asn1_d2i_read_bio to read headers without blocking Resolves: RHEL-178642 Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves: RHEL-179274 Resolves: RHEL-179287 Resolves: RHEL-179539 Resolves: RHEL-179544 Resolves: RHEL-179547 Resolves: RHEL-179552 Resolves: RHEL-179556 Resolves: RHEL-179633 Resolves: RHEL-179661 Resolves: RHEL-179678 Resolves: RHEL-179684 Resolves: RHEL-179688 Resolves: RHEL-179691 Resolves: RHEL-179696 Resolves: RHEL-179699 - Fix CVE-2026-28390 Resolves: RHEL-165870 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix globally disabled LTO Related: RHEL-111633 - Make openssl speed test signatures without errors Resolves: RHEL-95502 - Build tests in check and without LTO Resolves: RHEL-111633 - Add custom define to disable symbol versioning in downstream patched code Also add stricter Suggests for openssl-fips-provider Resolves: RHEL-104236 - Fix Requires/Provider to fix default install of fips providers Resolves: RHEL-104856 - Move fips.so to a seprate subpackage Reverts FIPS self test for SLH-DSA Add Suggests to try to prefer the openssl-fips-provider package over the fips-provider-next package by default Revolves: RHEL-102408 Related: RHEL-80854 - Patch asn1_d2i_read_bio to not raise NOT_ENOUGH_DATA at object boundary Resolves: RHEL-210862 - Patch asn1_d2i_read_bio to read headers without blocking Resolves: RHEL-178642 Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves: RHEL-179274 Resolves: RHEL-179287 Resolves: RHEL-179539 Resolves: RHEL-179544 Resolves: RHEL-179547 Resolves: RHEL-179552 Resolves: RHEL-179556 Resolves: RHEL-179633 Resolves: RHEL-179661 Resolves: RHEL-179678 Resolves: RHEL-179684 Resolves: RHEL-179688 Resolves: RHEL-179691 Resolves: RHEL-179696 Resolves: RHEL-179699 - Fix CVE-2026-28390 Resolves: RHEL-165870 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix globally disabled LTO Related: RHEL-111633 - Make openssl speed test signatures without errors Resolves: RHEL-95502 - Build tests in check and without LTO Resolves: RHEL-111633 - Add custom define to disable symbol versioning in downstream patched code Also add stricter Suggests for openssl-fips-provider Resolves: RHEL-104236 - Fix Requires/Provider to fix default install of fips providers Resolves: RHEL-104856 - Rebase to OpenSSL 3.5.8 Resolves: RHEL-242945 Resolves: RHEL-246260 Resolves: RHEL-246284 Resolves: RHEL-246319 Resolves: RHEL-246439 Resolves: RHEL-246443 Resolves: RHEL-246447 Resolves: RHEL-246451 Resolves: RHEL-246455 - Backport the "HollowByte" hardening patch Resolves: RHEL-232828 - Patch asn1_d2i_read_bio to not raise NOT_ENOUGH_DATA at object boundary Resolves: RHEL-210862 - Patch asn1_d2i_read_bio to read headers without blocking Resolves: RHEL-178642 Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves: RHEL-179274 Resolves: RHEL-179287 Resolves: RHEL-179539 Resolves: RHEL-179544 Resolves: RHEL-179547 Resolves: RHEL-179552 Resolves: RHEL-179556 Resolves: RHEL-179633 Resolves: RHEL-179661 Resolves: RHEL-179678 Resolves: RHEL-179684 Resolves: RHEL-179688 Resolves: RHEL-179691 Resolves: RHEL-179696 Resolves: RHEL-179699 - Fix CVE-2026-28390 Resolves: RHEL-165870 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix globally disabled LTO Related: RHEL-111633 - Fixed DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVE-2026-84782) Resolves: RHEL-264479 - Rebase to OpenSSL 3.5.8 Resolves: RHEL-242945 Resolves: RHEL-246260 Resolves: RHEL-246284 Resolves: RHEL-246319 Resolves: RHEL-246439 Resolves: RHEL-246443 Resolves: RHEL-246447 Resolves: RHEL-246451 Resolves: RHEL-246455 - Backport the "HollowByte" hardening patch Resolves: RHEL-232828 - Patch asn1_d2i_read_bio to not raise NOT_ENOUGH_DATA at object boundary Resolves: RHEL-210862 - Patch asn1_d2i_read_bio to read headers without blocking Resolves: RHEL-178642 Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves: RHEL-179274 Resolves: RHEL-179287 Resolves: RHEL-179539 Resolves: RHEL-179544 Resolves: RHEL-179547 Resolves: RHEL-179552 Resolves: RHEL-179556 Resolves: RHEL-179633 Resolves: RHEL-179661 Resolves: RHEL-179678 Resolves: RHEL-179684 Resolves: RHEL-179688 Resolves: RHEL-179691 Resolves: RHEL-179696 Resolves: RHEL-179699 - Fix CVE-2026-28390 Resolves: RHEL-165870 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix globally disabled LTO Related: RHEL-111633 - Make openssl speed test signatures without errors Resolves: RHEL-95502 - Build tests in check and without LTO Resolves: RHEL-111633 - Add custom define to disable symbol versioning in downstream patched code Also add stricter Suggests for openssl-fips-provider Resolves: RHEL-104236 - Fix Requires/Provider to fix default install of fips providers Resolves: RHEL-104856 - Move fips.so to a seprate subpackage Reverts FIPS self test for SLH-DSA Add Suggests to try to prefer the openssl-fips-provider package over the fips-provider-next package by default Revolves: RHEL-102408 Related: RHEL-80854 - Rebasing to OpenSSL 3.5.1 Resolves: RHEL-97797 Resolves: RHEL-98723 Resolves: RHEL-99352 - Compact patches for better maintainability Related: RHEL-80854 - Make hybrid MLKEM work with our FIPS provider (3.0.7) Resolves: RHEL-95239 - Fix regressions caused by rebase to OpenSSL 3.5 Related: RHEL-80854 - Fix CVE-2026-28390 Resolves: RHEL-165870 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix globally disabled LTO Related: RHEL-111633 - Make openssl speed test signatures without errors Resolves: RHEL-95502 - Build tests in check and without LTO Resolves: RHEL-111633 - Add custom define to disable symbol versioning in downstream patched code Also add stricter Suggests for openssl-fips-provider Resolves: RHEL-104236 - Fix Requires/Provider to fix default install of fips providers Resolves: RHEL-104856 - Move fips.so to a seprate subpackage Reverts FIPS self test for SLH-DSA Add Suggests to try to prefer the openssl-fips-provider package over the fips-provider-next package by default Revolves: RHEL-102408 Related: RHEL-80854 - Rebasing to OpenSSL 3.5.1 Resolves: RHEL-97797 Resolves: RHEL-98723 Resolves: RHEL-99352 - Compact patches for better maintainability Related: RHEL-80854 - Make hybrid MLKEM work with our FIPS provider (3.0.7) Resolves: RHEL-95239 Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves: RHEL-179274 Resolves: RHEL-179287 Resolves: RHEL-179539 Resolves: RHEL-179544 Resolves: RHEL-179547 Resolves: RHEL-179552 Resolves: RHEL-179556 Resolves: RHEL-179633 Resolves: RHEL-179661 Resolves: RHEL-179678 Resolves: RHEL-179684 Resolves: RHEL-179688 Resolves: RHEL-179691 Resolves: RHEL-179696 Resolves: RHEL-179699 - Fix CVE-2026-28390 Resolves: RHEL-165870 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix globally disabled LTO Related: RHEL-111633 - Make openssl speed test signatures without errors Resolves: RHEL-95502 - Build tests in check and without LTO Resolves: RHEL-111633 - Add custom define to disable symbol versioning in downstream patched code Also add stricter Suggests for openssl-fips-provider Resolves: RHEL-104236 - Fix Requires/Provider to fix default install of fips providers Resolves: RHEL-104856 - Move fips.so to a seprate subpackage Reverts FIPS self test for SLH-DSA Add Suggests to try to prefer the openssl-fips-provider package over the fips-provider-next package by default Revolves: RHEL-102408 Related: RHEL-80854 - Rebasing to OpenSSL 3.5.1 Resolves: RHEL-97797 Resolves: RHEL-98723 Resolves: RHEL-99352 - Patch asn1_d2i_read_bio to read headers without blocking Resolves: RHEL-178642 Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves: RHEL-179274 Resolves: RHEL-179287 Resolves: RHEL-179539 Resolves: RHEL-179544 Resolves: RHEL-179547 Resolves: RHEL-179552 Resolves: RHEL-179556 Resolves: RHEL-179633 Resolves: RHEL-179661 Resolves: RHEL-179678 Resolves: RHEL-179684 Resolves: RHEL-179688 Resolves: RHEL-179691 Resolves: RHEL-179696 Resolves: RHEL-179699 - Fix CVE-2026-28390 Resolves: RHEL-165870 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix globally disabled LTO Related: RHEL-111633 - Make openssl speed test signatures without errors Resolves: RHEL-95502 - Build tests in check and without LTO Resolves: RHEL-111633 - Add custom define to disable symbol versioning in downstream patched code Also add stricter Suggests for openssl-fips-provider Resolves: RHEL-104236 - Fix Requires/Provider to fix default install of fips providers Resolves: RHEL-104856 - Move fips.so to a seprate subpackage Reverts FIPS self test for SLH-DSA Add Suggests to try to prefer the openssl-fips-provider package over the fips-provider-next package by default Revolves: RHEL-102408 Related: RHEL-80854 - Patch asn1_d2i_read_bio to not raise NOT_ENOUGH_DATA at object boundary Resolves: RHEL-210862 - Patch asn1_d2i_read_bio to read headers without blocking Resolves: RHEL-178642 Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves: RHEL-179274 Resolves: RHEL-179287 Resolves: RHEL-179539 Resolves: RHEL-179544 Resolves: RHEL-179547 Resolves: RHEL-179552 Resolves: RHEL-179556 Resolves: RHEL-179633 Resolves: RHEL-179661 Resolves: RHEL-179678 Resolves: RHEL-179684 Resolves: RHEL-179688 Resolves: RHEL-179691 Resolves: RHEL-179696 Resolves: RHEL-179699 - Fix CVE-2026-28390 Resolves: RHEL-165870 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix globally disabled LTO Related: RHEL-111633 - Make openssl speed test signatures without errors Resolves: RHEL-95502 - Build tests in check and without LTO Resolves: RHEL-111633 - Add custom define to disable symbol versioning in downstream patched code Also add stricter Suggests for openssl-fips-provider Resolves: RHEL-104236 - Fix Requires/Provider to fix default install of fips providers Resolves: RHEL-104856 - Rebase to OpenSSL 3.5.8 Resolves: RHEL-242945 Resolves: RHEL-246260 Resolves: RHEL-246284 Resolves: RHEL-246319 Resolves: RHEL-246439 Resolves: RHEL-246443 Resolves: RHEL-246447 Resolves: RHEL-246451 Resolves: RHEL-246455 - Backport the "HollowByte" hardening patch Resolves: RHEL-232828 - Patch asn1_d2i_read_bio to not raise NOT_ENOUGH_DATA at object boundary Resolves: RHEL-210862 - Patch asn1_d2i_read_bio to read headers without blocking Resolves: RHEL-178642 Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves: RHEL-179274 Resolves: RHEL-179287 Resolves: RHEL-179539 Resolves: RHEL-179544 Resolves: RHEL-179547 Resolves: RHEL-179552 Resolves: RHEL-179556 Resolves: RHEL-179633 Resolves: RHEL-179661 Resolves: RHEL-179678 Resolves: RHEL-179684 Resolves: RHEL-179688 Resolves: RHEL-179691 Resolves: RHEL-179696 Resolves: RHEL-179699 - Fix CVE-2026-28390 Resolves: RHEL-165870 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix globally disabled LTO Related: RHEL-111633 - Fixed DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVE-2026-84782) Resolves: RHEL-264479 - Rebase to OpenSSL 3.5.8 Resolves: RHEL-242945 Resolves: RHEL-246260 Resolves: RHEL-246284 Resolves: RHEL-246319 Resolves: RHEL-246439 Resolves: RHEL-246443 Resolves: RHEL-246447 Resolves: RHEL-246451 Resolves: RHEL-246455 - Backport the "HollowByte" hardening patch Resolves: RHEL-232828 - Patch asn1_d2i_read_bio to not raise NOT_ENOUGH_DATA at object boundary Resolves: RHEL-210862 - Patch asn1_d2i_read_bio to read headers without blocking Resolves: RHEL-178642 Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves: RHEL-179274 Resolves: RHEL-179287 Resolves: RHEL-179539 Resolves: RHEL-179544 Resolves: RHEL-179547 Resolves: RHEL-179552 Resolves: RHEL-179556 Resolves: RHEL-179633 Resolves: RHEL-179661 Resolves: RHEL-179678 Resolves: RHEL-179684 Resolves: RHEL-179688 Resolves: RHEL-179691 Resolves: RHEL-179696 Resolves: RHEL-179699 - Fix CVE-2026-28390 Resolves: RHEL-165870 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix globally disabled LTO Related: RHEL-111633 - Make openssl speed test signatures without errors Resolves: RHEL-95502 - Build tests in check and without LTO Resolves: RHEL-111633 - Add custom define to disable symbol versioning in downstream patched code Also add stricter Suggests for openssl-fips-provider Resolves: RHEL-104236 - Fix Requires/Provider to fix default install of fips providers Resolves: RHEL-104856 - Move fips.so to a seprate subpackage Reverts FIPS self test for SLH-DSA Add Suggests to try to prefer the openssl-fips-provider package over the fips-provider-next package by default Revolves: RHEL-102408 Related: RHEL-80854 - Rebasing to OpenSSL 3.5.1 Resolves: RHEL-97797 Resolves: RHEL-98723 Resolves: RHEL-99352 - Compact patches for better maintainability Related: RHEL-80854 - Make hybrid MLKEM work with our FIPS provider (3.0.7) Resolves: RHEL-95239 - Fix regressions caused by rebase to OpenSSL 3.5 Related: RHEL-80854 - Fix CVE-2026-28390 Resolves: RHEL-165870 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix globally disabled LTO Related: RHEL-111633 - Make openssl speed test signatures without errors Resolves: RHEL-95502 - Build tests in check and without LTO Resolves: RHEL-111633 - Add custom define to disable symbol versioning in downstream patched code Also add stricter Suggests for openssl-fips-provider Resolves: RHEL-104236 - Fix Requires/Provider to fix default install of fips providers Resolves: RHEL-104856 - Move fips.so to a seprate subpackage Reverts FIPS self test for SLH-DSA Add Suggests to try to prefer the openssl-fips-provider package over the fips-provider-next package by default Revolves: RHEL-102408 Related: RHEL-80854 - Rebasing to OpenSSL 3.5.1 Resolves: RHEL-97797 Resolves: RHEL-98723 Resolves: RHEL-99352 - Compact patches for better maintainability Related: RHEL-80854 - Make hybrid MLKEM work with our FIPS provider (3.0.7) Resolves: RHEL-95239 Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves: RHEL-179274 Resolves: RHEL-179287 Resolves: RHEL-179539 Resolves: RHEL-179544 Resolves: RHEL-179547 Resolves: RHEL-179552 Resolves: RHEL-179556 Resolves: RHEL-179633 Resolves: RHEL-179661 Resolves: RHEL-179678 Resolves: RHEL-179684 Resolves: RHEL-179688 Resolves: RHEL-179691 Resolves: RHEL-179696 Resolves: RHEL-179699 - Fix CVE-2026-28390 Resolves: RHEL-165870 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix globally disabled LTO Related: RHEL-111633 - Make openssl speed test signatures without errors Resolves: RHEL-95502 - Build tests in check and without LTO Resolves: RHEL-111633 - Add custom define to disable symbol versioning in downstream patched code Also add stricter Suggests for openssl-fips-provider Resolves: RHEL-104236 - Fix Requires/Provider to fix default install of fips providers Resolves: RHEL-104856 - Move fips.so to a seprate subpackage Reverts FIPS self test for SLH-DSA Add Suggests to try to prefer the openssl-fips-provider package over the fips-provider-next package by default Revolves: RHEL-102408 Related: RHEL-80854 - Rebasing to OpenSSL 3.5.1 Resolves: RHEL-97797 Resolves: RHEL-98723 Resolves: RHEL-99352 - Patch asn1_d2i_read_bio to read headers without blocking Resolves: RHEL-178642 Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves: RHEL-179274 Resolves: RHEL-179287 Resolves: RHEL-179539 Resolves: RHEL-179544 Resolves: RHEL-179547 Resolves: RHEL-179552 Resolves: RHEL-179556 Resolves: RHEL-179633 Resolves: RHEL-179661 Resolves: RHEL-179678 Resolves: RHEL-179684 Resolves: RHEL-179688 Resolves: RHEL-179691 Resolves: RHEL-179696 Resolves: RHEL-179699 - Fix CVE-2026-28390 Resolves: RHEL-165870 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix globally disabled LTO Related: RHEL-111633 - Make openssl speed test signatures without errors Resolves: RHEL-95502 - Build tests in check and without LTO Resolves: RHEL-111633 - Add custom define to disable symbol versioning in downstream patched code Also add stricter Suggests for openssl-fips-provider Resolves: RHEL-104236 - Fix Requires/Provider to fix default install of fips providers Resolves: RHEL-104856 - Move fips.so to a seprate subpackage Reverts FIPS self test for SLH-DSA Add Suggests to try to prefer the openssl-fips-provider package over the fips-provider-next package by default Revolves: RHEL-102408 Related: RHEL-80854 - Patch asn1_d2i_read_bio to not raise NOT_ENOUGH_DATA at object boundary Resolves: RHEL-210862 - Patch asn1_d2i_read_bio to read headers without blocking Resolves: RHEL-178642 Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves: RHEL-179274 Resolves: RHEL-179287 Resolves: RHEL-179539 Resolves: RHEL-179544 Resolves: RHEL-179547 Resolves: RHEL-179552 Resolves: RHEL-179556 Resolves: RHEL-179633 Resolves: RHEL-179661 Resolves: RHEL-179678 Resolves: RHEL-179684 Resolves: RHEL-179688 Resolves: RHEL-179691 Resolves: RHEL-179696 Resolves: RHEL-179699 - Fix CVE-2026-28390 Resolves: RHEL-165870 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix globally disabled LTO Related: RHEL-111633 - Make openssl speed test signatures without errors Resolves: RHEL-95502 - Build tests in check and without LTO Resolves: RHEL-111633 - Add custom define to disable symbol versioning in downstream patched code Also add stricter Suggests for openssl-fips-provider Resolves: RHEL-104236 - Fix Requires/Provider to fix default install of fips providers Resolves: RHEL-104856 - Rebase to OpenSSL 3.5.8 Resolves: RHEL-242945 Resolves: RHEL-246260 Resolves: RHEL-246284 Resolves: RHEL-246319 Resolves: RHEL-246439 Resolves: RHEL-246443 Resolves: RHEL-246447 Resolves: RHEL-246451 Resolves: RHEL-246455 - Backport the "HollowByte" hardening patch Resolves: RHEL-232828 - Patch asn1_d2i_read_bio to not raise NOT_ENOUGH_DATA at object boundary Resolves: RHEL-210862 - Patch asn1_d2i_read_bio to read headers without blocking Resolves: RHEL-178642 Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves: RHEL-179274 Resolves: RHEL-179287 Resolves: RHEL-179539 Resolves: RHEL-179544 Resolves: RHEL-179547 Resolves: RHEL-179552 Resolves: RHEL-179556 Resolves: RHEL-179633 Resolves: RHEL-179661 Resolves: RHEL-179678 Resolves: RHEL-179684 Resolves: RHEL-179688 Resolves: RHEL-179691 Resolves: RHEL-179696 Resolves: RHEL-179699 - Fix CVE-2026-28390 Resolves: RHEL-165870 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix globally disabled LTO Related: RHEL-111633 - Fixed DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVE-2026-84782) Resolves: RHEL-264479 - Rebase to OpenSSL 3.5.8 Resolves: RHEL-242945 Resolves: RHEL-246260 Resolves: RHEL-246284 Resolves: RHEL-246319 Resolves: RHEL-246439 Resolves: RHEL-246443 Resolves: RHEL-246447 Resolves: RHEL-246451 Resolves: RHEL-246455 - Backport the "HollowByte" hardening patch Resolves: RHEL-232828 - Patch asn1_d2i_read_bio to not raise NOT_ENOUGH_DATA at object boundary Resolves: RHEL-210862 - Patch asn1_d2i_read_bio to read headers without blocking Resolves: RHEL-178642 Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves: RHEL-179274 Resolves: RHEL-179287 Resolves: RHEL-179539 Resolves: RHEL-179544 Resolves: RHEL-179547 Resolves: RHEL-179552 Resolves: RHEL-179556 Resolves: RHEL-179633 Resolves: RHEL-179661 Resolves: RHEL-179678 Resolves: RHEL-179684 Resolves: RHEL-179688 Resolves: RHEL-179691 Resolves: RHEL-179696 Resolves: RHEL-179699 - Fix CVE-2026-28390 Resolves: RHEL-165870 - Fix CVE-2026-31790 Resolves: RHEL-161586 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-142024 Resolves: RHEL-142028 Resolves: RHEL-142032 Resolves: RHEL-142036 Resolves: RHEL-142040 Resolves: RHEL-142044 Resolves: RHEL-142048 Resolves: RHEL-142052 Resolves: RHEL-142056 - Fix CVE-2025-9230 Resolves: RHEL-115928 - Fix coverity issues introduced with recent changes - Fix sending parameters for RSA-OAEP operations (#2063378) - Improve logging and fix selection of expired certificates (#2029834) - 50mounted-tests: trap do_unmount function on errors - Resolves: RHEL-41244 - 90fallback: include possible kernel parameters from grub's default file - common.sh: do not resolve symbolic link on mapped device filesystems - Resolves: #RHEL-44705 - Fix inheritance of environment build flags - Resolves: #2144572 - Rebase to 0.26.2 Resolves: RHEL-147825 - Rebase to 0.26.1 Resolves: RHEL-139075, RHEL-118361, RHEL-126132 - Update to new upstream release 0.25.10 Resolves: RHEL-115453 - Fix regression in trust where file creation fails for long cert labels Resolves: RHEL-58899 - Fix usage message in p11-kit list-tokens command Resolves: RHEL-31810 - Rebase to 0.26.2 Resolves: RHEL-147825 - Rebase to 0.26.1 Resolves: RHEL-139075, RHEL-118361, RHEL-126132 - Update to new upstream release 0.25.10 Resolves: RHEL-115453 - Fix regression in trust where file creation fails for long cert labels Resolves: RHEL-58899 - Fix usage message in p11-kit list-tokens command Resolves: RHEL-31810 - Rebase to 0.26.2 Resolves: RHEL-147825 - Rebase to 0.26.1 Resolves: RHEL-139075, RHEL-118361, RHEL-126132 - Update to new upstream release 0.25.10 Resolves: RHEL-115453 - Fix regression in trust where file creation fails for long cert labels Resolves: RHEL-58899 - Fix usage message in p11-kit list-tokens command Resolves: RHEL-31810 - Rebase to 0.26.2 Resolves: RHEL-147825 - Rebase to 0.26.1 Resolves: RHEL-139075, RHEL-118361, RHEL-126132 - Update to new upstream release 0.25.10 Resolves: RHEL-115453 - Fix regression in trust where file creation fails for long cert labels Resolves: RHEL-58899 - Fix usage message in p11-kit list-tokens command Resolves: RHEL-31810 - Rebase to 0.26.2 Resolves: RHEL-147825 - Rebase to 0.26.1 Resolves: RHEL-139075, RHEL-118361, RHEL-126132 - Update to new upstream release 0.25.10 Resolves: RHEL-115453 - Fix regression in trust where file creation fails for long cert labels Resolves: RHEL-58899 - Fix usage message in p11-kit list-tokens command Resolves: RHEL-31810 - Rebase to 0.26.2 Resolves: RHEL-147825 - Rebase to 0.26.1 Resolves: RHEL-139075, RHEL-118361, RHEL-126132 - Update to new upstream release 0.25.10 Resolves: RHEL-115453 - Fix regression in trust where file creation fails for long cert labels Resolves: RHEL-58899 - Fix usage message in p11-kit list-tokens command Resolves: RHEL-31810 - pam_faillock: skip clearing user's failed attempt. Resolves: RHEL-130875 - pam_unix: sync expiry checks with shadow. Resolves: RHEL-70519, RHEL-95475, RHEL-96955 and RHEL-96973 - pam.conf: remove tallylog. Resolves: RHEL-15324 - pam_namespace: fix potential privilege escalation. Resolves: CVE-2025-6020 and RHEL-96727 - pam_access: rework resolving of tokens as hostname. Resolves: CVE-2024-10963 and RHEL-66244 - pam_unix: always run the helper to obtain shadow password file entries. CVE-2024-10041. Resolves: RHEL-62879 - pam_access: always match local address and clarify LOCAL keyword behaviour. Resolves: RHEL-23631 and RHEL-39943 - libpam: support long lines in service files. Resolves: RHEL-40705 - pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS situations. CVE-2024-22365. Resolves: RHEL-21244 - libpam: use getlogin() from libc and not utmp. Resolves: RHEL-16727 - pam_access: handle hostnames in access.conf. Resolves: RHEL-22300 - pam_faillock: create tallydir before creating tallyfile. Resolves: RHEL-20943 - pam_userdb: fix password comparison timing leak. Resolves: CVE-2026-54411 and RHEL-191702 - pam_faillock: skip clearing user's failed attempt. Resolves: RHEL-130875 - pam_unix: sync expiry checks with shadow. Resolves: RHEL-70519, RHEL-95475, RHEL-96955 and RHEL-96973 - pam.conf: remove tallylog. Resolves: RHEL-15324 - pam_namespace: fix potential privilege escalation. Resolves: CVE-2025-6020 and RHEL-96727 - pam_access: rework resolving of tokens as hostname. Resolves: CVE-2024-10963 and RHEL-66244 - pam_unix: always run the helper to obtain shadow password file entries. CVE-2024-10041. Resolves: RHEL-62879 - pam_access: always match local address and clarify LOCAL keyword behaviour. Resolves: RHEL-23631 and RHEL-39943 - tests: Add test for dvh with a bad checksum (bcl) Related: RHEL-73217 - libparted: Fix dvh disklabel unhandled exception (bcl) Related: RHEL-73217 - tests: Add test for SUN disklabel handling (bcl) Related: RHEL-73217 - libparted: Fix sun disklabel unhandled exception (bcl) Resolves: RHEL-73217 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - fix inconsistencies in manpage - fix incorrect -S output Resolves: #1612221, #1740166 - add support for cxl1.1 device link status information (#RHEL-29162) - add PCIe 6.0 data rate (64 GT/s) support (#RHEL-61959) - add support for cxl1.1 device link status information (#RHEL-29162) - add PCIe 6.0 data rate (64 GT/s) support (#RHEL-61959) - Fix the SAST reports described in RHEL-32492 and RHEL-32488 - Fix SEGFAULT caused by dereferencing subject when length==0 on aarch64 - Resolves: RHEL-51866 - Rebuilt for added pcre2-tools into CRB - Fix an issue with restoring originally unset entries in recursion - Resolves: BZ#2248133 - Fix issue in the backtracking optimization of character in JIT - Backport multiple CVE fixes - CVE-2026-86145, CVE-2026-89156, CVE-2026-89157, CVE-2026-89158, CVE-2026-89160, CVE-2026-89161 - Fix SEGFAULT caused by dereferencing subject when length==0 on aarch64 - Resolves: RHEL-51866 - Rebuilt for added pcre2-tools into CRB - Fix an issue with restoring originally unset entries in recursion - Resolves: BZ#2248133 - Fix issue in the backtracking optimization of character in JIT - Backport multiple CVE fixes - CVE-2026-86145, CVE-2026-89156, CVE-2026-89157, CVE-2026-89158, CVE-2026-89160, CVE-2026-89161 - Backport --disable-polkit option (RHEL-34856) - Rebase to current version from Fedora to fix support for Alcor Micro Corp. AU9540 (#2209457) - Rebase to current version from Fedora (#2017830) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Increase the maximum readers count (#1975424) - Backport --disable-polkit option (RHEL-34856) - Fix RDMA CM DMAH bug - Resolves: RHEL-134210 - Rebuilt for RHEL-9.8 - Resolves: RHEL-134210 - Update to upstream release 25.10.0.0.128 - Resolves: RHEL-134210 - Update to upstream release 25.04.0.0.84 - Resolves: RHEL-99801 - Update to upstream release 24.07.0.0.44 - Resolves: RHEL-66185 - Update to upstream v2.8 - Resolves: RHEL-70287 - Skipping softhsm tests for tls - Enable gating - Initial commit on c9s - Don't prepend sysroot_dir if pkg-config file lies outside of sysroot_dir resolves: rhbz#1975416 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Conditionalize the unit tests, disable them on RHEL 9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use internal target platform definition for pkg-config wrapper - Fix pkg-config wrapper for armv7hl - Make /usr/bin/pkg-config multilib safe - Add /usr/local paths to pkg-config(1) search path for non RPM builds - Update to 1.7.3 - Don't prepend sysroot_dir if pkg-config file lies outside of sysroot_dir resolves: rhbz#1975416 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Conditionalize the unit tests, disable them on RHEL 9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use internal target platform definition for pkg-config wrapper - Fix pkg-config wrapper for armv7hl - Make /usr/bin/pkg-config multilib safe - Add /usr/local paths to pkg-config(1) search path for non RPM builds - Update to 1.7.3 - Don't prepend sysroot_dir if pkg-config file lies outside of sysroot_dir resolves: rhbz#1975416 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Conditionalize the unit tests, disable them on RHEL 9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use internal target platform definition for pkg-config wrapper - Fix pkg-config wrapper for armv7hl - Make /usr/bin/pkg-config multilib safe - Add /usr/local paths to pkg-config(1) search path for non RPM builds - Update to 1.7.3 - sandbox/seunshare: Replace system() with execv() to prevent shell injection - seunshare: fix the frail tmpdir cleanup - semanage: Reset active value when deleting boolean customizations - restorecond: always add '\0' to ut_user - semanage: Allow modifying records on "add" - semanage: Do not sort local fcontext definitions - sandbox/seunshare: Replace system() with execv() to prevent shell injection - seunshare: fix the frail tmpdir cleanup - semanage: Reset active value when deleting boolean customizations - restorecond: always add '\0' to ut_user - semanage: Allow modifying records on "add" - semanage: Do not sort local fcontext definitions - sandbox/seunshare: Replace system() with execv() to prevent shell injection - seunshare: fix the frail tmpdir cleanup - semanage: Reset active value when deleting boolean customizations - restorecond: always add '\0' to ut_user - semanage: Allow modifying records on "add" - semanage: Do not sort local fcontext definitions - aarch64: test failure with undefined symbol: __aarch64_ldadd4_acq_rel - Resolves: RHEL-98662 - session-monitor: watch sessions only - PolkitPermission: react on really changed sessions - allow polkit-pkla-compat to be uninstalled if no .pkla rules - Resolves: RHEL-39063 - pkttyagent: EOF in passwd results in coredump - Resolves: RHEL-5772 - aarch64: test failure with undefined symbol: __aarch64_ldadd4_acq_rel - Resolves: RHEL-98662 - session-monitor: watch sessions only - PolkitPermission: react on really changed sessions - allow polkit-pkla-compat to be uninstalled if no .pkla rules - Resolves: RHEL-39063 - pkttyagent: EOF in passwd results in coredump - Resolves: RHEL-5772 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gating.yaml - Address important covscan issues (#1938846) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Conditionalize static subpackage during build-time - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to popt 1.18 final (no changes from rc1) - Rebase to popt 1.18-rc1 - Update URLs to the new upstream - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New version Resolves: rhbz#1912617 - Added workaround for Windows Server 2019 Resolves: rhbz#1867047 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Added missing options to man pages - Updated EAP-TLS patch to v1.300 - Updated EAP-TLS patch to v1.201 - Fix key import API to return NOTTRUSTED for disabled algorithms (RHEL-112700) - Ignore signatures made by unknown or disabled algorithms (RHEL-112700) - Fix rpmsign(8) man page (RHEL-109233) - Additional PQC-related fixes (RHEL-109233) - Add signing support (RHEL-107536) - Initial commit on c9s (RHEL-84699) - Fix key import API to return NOTTRUSTED for disabled algorithms (RHEL-112700) - Ignore signatures made by unknown or disabled algorithms (RHEL-112700) - Fix rpmsign(8) man page (RHEL-109233) - Additional PQC-related fixes (RHEL-109233) - Add signing support (RHEL-107536) - Initial commit on c9s (RHEL-84699) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - top: processes for specific user not displayed if sorted by mem - Resolves: RHEL-16278 - ps: mitigation of possible buffer overflow - Resolves: rhbz#2228504 - sysctl: '-N' option shows values instead of names if '-p' - Resolves: rhbz#2222056 - version bump requested to create -devel subpkg for CRB inclusion - Resolves: rhbz#2158253 - ps: out-of-bonds read in quick mode - Resolves: rhbz#2161648 - display.c: backport: async-signal-unsafe handler deadlocks on SIGHUP - Resolves: rhbz#2141697 - pgrep: uid/gid overflow fix backport - Resolves: rhbz#2119083 - sysctl: backport - keys with dots instead of slashes again - Resolves: rhbz#2116977 - Related: rhbz#2052536 - free: backport new 'used' calculation - sysctl: backport support of systemd glob patterns - Resolves: rhbz#2003033 - Resolves: rhbz#2052536 - uptime: human readable data not shown if 364 days up - Resolves: rhbz#2067166 - top: processes for specific user not displayed if sorted by mem - Resolves: RHEL-16278 - ps: mitigation of possible buffer overflow - Resolves: rhbz#2228504 - sysctl: '-N' option shows values instead of names if '-p' - Resolves: rhbz#2222056 - version bump requested to create -devel subpkg for CRB inclusion - Resolves: rhbz#2158253 - ps: out-of-bonds read in quick mode - Resolves: rhbz#2161648 - display.c: backport: async-signal-unsafe handler deadlocks on SIGHUP - Resolves: rhbz#2141697 - pgrep: uid/gid overflow fix backport - Resolves: rhbz#2119083 - sysctl: backport - keys with dots instead of slashes again - Resolves: rhbz#2116977 - Related: rhbz#2052536 - free: backport new 'used' calculation - sysctl: backport support of systemd glob patterns - Resolves: rhbz#2003033 - Resolves: rhbz#2052536 - uptime: human readable data not shown if 364 days up - Resolves: rhbz#2067166 - Applied patch for for CVE-2022-48468 (#2186677) - Adapt tests to protobuf-c 1.3.3 - Added gating tests - Rebuilt for errata - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - tmpfiles.d integration - Resolves: RHEL-109878 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 * Rebase to psmisc-23.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebase build failed due to missing peekfd export on aarch64 - Rebase to v23.3 - Related: bz#1768993 - Rebase to v23.2 - Related: bz#1768993 - unset writable-by-group permission bit on the license file - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Recent revision - 20210518 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Security fix for CVE-2026-15308 Resolves: RHEL-193786 - Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+ Resolves: RHEL-194207 - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-167919, RHEL-168161 - Security fix for CVE-2026-4519 Resolves: RHEL-158117 - Rebuilding previous fixes for different build target Related: RHEL-143117, RHEL-143174, RHEL-144897 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143117 Resolves: RHEL-143174 Resolves: RHEL-144897 - Security fix for CVE-2025-12084 Resolves: RHEL-135897 - Move _sysconfigdata_d_linux*.py to the debug subpackage - Update to Python 3.9.25 - Update to Python 3.9.24 - Security fix for CVE-2026-11940 Resolves: RHEL-227228 - Security fix for CVE-2026-15308 Resolves: RHEL-193786 - Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+ Resolves: RHEL-194207 - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-167919, RHEL-168161 - Security fix for CVE-2026-4519 Resolves: RHEL-158117 - Rebuilding previous fixes for different build target Related: RHEL-143117, RHEL-143174, RHEL-144897 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143117 Resolves: RHEL-143174 Resolves: RHEL-144897 - Security fix for CVE-2025-12084 Resolves: RHEL-135897 - Move _sysconfigdata_d_linux*.py to the debug subpackage - Update to Python 3.9.25 - CVE-2026-19553 python3.9: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() Resolves: RHEL-274143 - CVE-2026-19445 python3.9: Use-after-free of a server-side SSLContext when sni_callback switches contexts Resolves: RHEL-276263 - CVE-2026-12345 python3.9: python: Arbitrary file deletion via race condition during temporary directory cleanup Resolves: RHEL-272937 - Security fix for CVE-2026-11940 Resolves: RHEL-227228 - Security fix for CVE-2026-15308 Resolves: RHEL-193786 - Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+ Resolves: RHEL-194207 - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-167919, RHEL-168161 - Security fix for CVE-2026-4519 Resolves: RHEL-158117 - Rebuilding previous fixes for different build target Related: RHEL-143117, RHEL-143174, RHEL-144897 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143117 Resolves: RHEL-143174 Resolves: RHEL-144897 - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-167919, RHEL-168161 - Security fix for CVE-2026-4519 Resolves: RHEL-158117 - Rebuilding previous fixes for different build target Related: RHEL-143117, RHEL-143174, RHEL-144897 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143117 Resolves: RHEL-143174 Resolves: RHEL-144897 - Security fix for CVE-2025-12084 Resolves: RHEL-135897 - Move _sysconfigdata_d_linux*.py to the debug subpackage - Update to Python 3.9.25 - Update to Python 3.9.24 - Security fix for CVE-2025-8194 Resolves: RHEL-106374 - Update to 3.9.23 - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435 Resolves: RHEL-98051, RHEL-98024, RHEL-98242, RHEL-98193, RHEL-98218 - Add automatically generated Obsoletes tag with the python39- prefix for smoother upgrade from RHEL8 - Related: rhbz#1990421 - Rebuilt for libffi 3.4.2 SONAME transition. Related: rhbz#1891914 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 1.14.5 Resolves: rhbz#1927933 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.14.3 - Update to 1.14.2 (#1869032) - Update to 1.14.1 - Fixes: rhbz#1860698 - Fixes: rhbz#1865276 - Rebuilt for Python 3.9 - Add gating configuration and a simple smoke test - Related: rhbz#1950291 - Add automatically generated Obsoletes tag with the python39- prefix for smoother upgrade from RHEL8 - Related: rhbz#1990421 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 4.0.0 - Fixes: rhbz#1906585 - Fixes: rhbz#1923076 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Bootstrap for Python 3.9 - Debrand for AlmaLinux - fix: Print list of environments without --set/--list (jhnidek@redhat.com) - RHEL-126157: Update GCP to Google Cloud in log messages (crag@redhat.com) - fix: Update user-facing GCP refrences to Google Cloud (crag@redhat.com) - feat: check if --set arg is empty when the environments module is called (manuelcanorojo@gmail.com) - feat: Added more debug prints to cloud-what (jhnidek@redhat.com) - fix(test): Fix unit test of aws (jhnidek@redhat.com) - fix: Fix getting AWS IMDSv2 signature (jhnidek@redhat.com) - chore: Make new black happy again (jhnidek@redhat.com) - chore: Increased log level of messages (jhnidek@redhat.com) - fix: Use IMDSv2 for signature first (jhnidek@redhat.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Georgian) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Added translation using Weblate (Finnish) (noreply-addon- languages@weblate.org) - fix: TypeError in _get_tls_handshake_info type hinting (macano@redhat.com) - feat: added signature type log in TLS handshake (macano@redhat.com) - feat: added internal method to get tls handshake info (manuelcanorojo@gmail.com) - ci: bump actions/upload-artifact from 5 to 6 (49699333+dependabot[bot]@users.noreply.github.com) - Fix profile upload because of missing self.cp (suttner@atix.de) - Fix upload profile if rhsmcertd is not running at all (suttner@atix.de) - ci: bump actions/checkout from 5 to 6 (49699333+dependabot[bot]@users.noreply.github.com) - Translated using Weblate (Korean) (simmon@nplob.com) - ci: bump actions/upload-artifact from 4 to 5 (49699333+dependabot[bot]@users.noreply.github.com) - feat: [1.29] Added dnf4 warning about skewed clock (jhnidek@redhat.com) - fix: [1.29] Require findutils in .spec file (jhnidek@redhat.com) - ci: bump actions/checkout from 4 to 5 (49699333+dependabot[bot]@users.noreply.github.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Spanish) (fserrador@gmail.com) - Translated using Weblate (Spanish) (jsefler@redhat.com) - Translated using Weblate (Korean) (simmon@nplob.com) - fix: [1.29] Wait random time before reaching IMDS server (jhnidek@redhat.com) - feat: [1.29] Call random.seed() at begining of auto-register (jhnidek@redhat.com) - feat: [1.29] Better control over auto-reg waiting game (jhnidek@redhat.com) - fix: [1.29] Enable content during auto-registration v2 (jhnidek@redhat.com) - Translated using Weblate (Italian) (info@salvatorecocuzza.it) - Translated using Weblate (Italian) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (Italian) (info@salvatorecocuzza.it) - Translated using Weblate (Spanish) (fserrador@gmail.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Chinese (Traditional) (zh_TW)) (chzang55@gmail.com) - Translated using Weblate (Chinese (Simplified) (zh_CN)) (mhorky@redhat.com) - Translated using Weblate (Georgian) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (French) (leane.grasser@proton.me) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (Korean) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (Korean) (noreply-mt-weblate-translation- memory@weblate.org) - Update translation files (noreply@weblate.org) - fix: Handle improperly closed connections (mhorky@redhat.com) - ci: use the right distro for coverage reporting (ptoscano@redhat.com) - New extraction for translatable strings (ptoscano@redhat.com) - Translated using Weblate (Italian) (toscano.pino@tiscali.it) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (French) (leane.grasser@proton.me) - tests: fix mocking of get_terminal_width() in TestColumnize (ptoscano@redhat.com) - feat: print compliance errors & syspurpose status only in entitlement mode (ptoscano@redhat.com) - feat: print "registered" as status when using SCA (ptoscano@redhat.com) - feat: print "not registered" on status when not registered (ptoscano@redhat.com) - tests: force syspurpose tests in test_status to non-SCA (ptoscano@redhat.com) - refactor: move determination of content access mode in own method (ptoscano@redhat.com) - tests: move StubIdentity to stubs (ptoscano@redhat.com) - tests: cleanup dead/broken bits in test_status (ptoscano@redhat.com) - chore: move banner printing to its own function (ptoscano@redhat.com) - fix: Append two additional facts to the graylist (pkoprda@redhat.com) - refactor: Use class constant instead of variable graylist (pkoprda@redhat.com) - fix: Do not upload profile from DNF, when it is disabled in conf (jhnidek@redhat.com) - feat: dnf plugin - outsource uploading of profile to rhsmcertd. (jhnidek@redhat.com) - feat: Enable register with environment names and environment types (jhnidek@redhat.com) - feat: support registering specifying environments with activation keys (ryanverdile@gmail.com) - chore: Remove auto-assign CI job (mhorky@redhat.com) - feat: [1.29] Added basic configuration for Packit (jhnidek@redhat.com) - Revert "feat: Disable anonymous cloud registration temporarily" (ptoscano@redhat.com) - Revert "feat: forcefully switch automatic cloud registration to v1" (ptoscano@redhat.com) - Translated using Weblate (Chinese (Simplified) (zh_CN)) (ptoscano@redhat.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (French) (leane.grasser@proton.me) - Update translation files (noreply@weblate.org) - New extraction for translatable strings (ptoscano@redhat.com) - Translated using Weblate (Italian) (info@salvatorecocuzza.it) - Translated using Weblate (French) (leane.grasser@proton.me) - Translated using Weblate (German) (atalanttore@googlemail.com) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - [1.29] feat/cct-868: Subset of list command options marked as deprecated * Options --available, --all, --ondate, --servicelevel --no-overlap --match- install, --pool-only, --afterdate were marked as deprecated in ListCommand definition of their help string. (mgrunwal@redhat.com) - fix: Handle Retry-After headers better for 429 responses (mhorky@redhat.com) - feat: Better automatic registration logging (mhorky@redhat.com) - fix: perform autoreg waiting when performing standard autoreg (ptoscano@redhat.com) - chore: move autoreg waiting code in own function (ptoscano@redhat.com) - docs: update proxy details in man page (jvlcek@redhat.com) - feat: forcefully switch automatic cloud registration to v1 (ptoscano@redhat.com) - Update to the latest upstream version - Fix CVE-2023-49083: NULL-dereference when loading PKCS7 certificates, resolves RHEL-19830 - Fix FTBFS caused by rsa_pkcs1_implicit_rejection OpenSSL feature, resolves rhbz#2203840 - Fix CVE-2023-23931: Don't allow update_into to mutate immutable objects, resolves rhbz#2172399 - Fix FTBFS due to failing test_load_invalid_ec_key_from_pem and test_decrypt_invalid_decrypt - Rebuild for gating, related: rhbz#2060787 - Rebase to 36.0.1, related: rhbz#2059630, rhbz#2060787 - OpenSSL 3.0 FIPS mode is now detected correctly, related: rhbz#2054785 - Fix error check from EVP_PKEY_CTX_set_signature_md, related: rhbz#2060343 - Block 3DES in FIPS mode, related: rhbz#2055209 - Disable DSA tests in FIPS mode - Enable SHA1 signatures in test suite - Fix serialization of keyusage ext with no bits - Re-enable tests that are passing again - Skip unstable memleak tests, backported from Fedora (BZ#2042413) - Related: rhbz#1990421 - Add automatically generated Obsoletes tag with the python39- prefix for smoother upgrade from RHEL8 - Related: rhbz#1990421 - Fix gating issues, resolves: rhbz#2039768 - Fix poly1305 test, resolves: rhbz#2043582 - Update to 2.9.0.post0 and revise patches Resolves: RHEL-113228 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update to 1.2.18 (#1985856) - Verify GPG signature of sources - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Update to 1.2.16 (#1788491) - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Subpackage python2-dbus has been removed See https://fedoraproject.org/wiki/Changes/RetirePython2 - Rebuilt for Python 3.8.0rc1 (#1748018) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - new version Remove python39.patch no longer needed - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Subpackage python2-decorator has been removed See https://fedoraproject.org/wiki/Changes/RetirePython2 - Rebuilt for Python 3.8.0rc1 (#1748018) - Rebuilt for Python 3.8 - Added patch for almalinux bugtracker - bootc: unlock only if /usr is read-only (RHEL-138512) - autoremove: when a dangling protected dependency is found produce a wanrning and skip it (RHEL-76112) - automatic: Expand email_to in command_email emitter to individual arguments (RHEL-94321) - Introduce $releasever_major, $releasever_minor variables, shell-style variable substitution (RHEL-65817) - Mark transient transactions in DNF history (RHEL-84512) - Warn/disallow changes outside /usr, /etc with --transient (RHEL-84499) - man page: don't mark mandatory option parameters as optional (RHEL-63958) - Add dnf4 provides and symlink /usr/bin/dnf4 -> /usr/bin/dnf-3 (RHEL-82310) - usage help: don't mark mandatory option parameters as optional (RHEL-63958) - package: remote_location() takes basedir into account (RHEL-71125) - Multisig: ignore untrusted signatures if there is trusted one (RHEL-145372) - Document that local packages are not affected by versionlock (RHEL-94014) - Rename dnf4-multisig(8) manual page to dnf-multisig(8) (RHEL-117134) - Fix importing OpenPGPv6 keys (RHEL-114424) - Add multisig plugin (RHEL-100157) - reposync: Avoid multiple downloads of duplicate packages (RHEL-64320) - Fix bogus changelog entry date - Add forgotten changelog - Backport patch: "dnf copr enable" on "Asahi Fedora Linux Remix" guesses (RHEL-56143) - needs-restarting: Get boot time from systemd UnitsLoadStartTimestamp (RHEL-14900) - reposync: Respect --norepopath with --metadata-path (RHEL-40914) - Multisig: ignore untrusted signatures if there is trusted one (RHEL-145372) - Document that local packages are not affected by versionlock (RHEL-94014) - Rename dnf4-multisig(8) manual page to dnf-multisig(8) (RHEL-117134) - Fix importing OpenPGPv6 keys (RHEL-114424) - Add multisig plugin (RHEL-100157) - reposync: Avoid multiple downloads of duplicate packages (RHEL-64320) - Fix bogus changelog entry date - Add forgotten changelog - Backport patch: "dnf copr enable" on "Asahi Fedora Linux Remix" guesses (RHEL-56143) - needs-restarting: Get boot time from systemd UnitsLoadStartTimestamp (RHEL-14900) - reposync: Respect --norepopath with --metadata-path (RHEL-40914) - Multisig: ignore untrusted signatures if there is trusted one (RHEL-145372) - Document that local packages are not affected by versionlock (RHEL-94014) - Rename dnf4-multisig(8) manual page to dnf-multisig(8) (RHEL-117134) - Fix importing OpenPGPv6 keys (RHEL-114424) - Add multisig plugin (RHEL-100157) - reposync: Avoid multiple downloads of duplicate packages (RHEL-64320) - Fix bogus changelog entry date - Add forgotten changelog - Backport patch: "dnf copr enable" on "Asahi Fedora Linux Remix" guesses (RHEL-56143) - needs-restarting: Get boot time from systemd UnitsLoadStartTimestamp (RHEL-14900) - reposync: Respect --norepopath with --metadata-path (RHEL-40914) - Multisig: ignore untrusted signatures if there is trusted one (RHEL-145372) - Document that local packages are not affected by versionlock (RHEL-94014) - Rename dnf4-multisig(8) manual page to dnf-multisig(8) (RHEL-117134) - Fix importing OpenPGPv6 keys (RHEL-114424) - Add multisig plugin (RHEL-100157) - reposync: Avoid multiple downloads of duplicate packages (RHEL-64320) - Fix bogus changelog entry date - Add forgotten changelog - Backport patch: "dnf copr enable" on "Asahi Fedora Linux Remix" guesses (RHEL-56143) - needs-restarting: Get boot time from systemd UnitsLoadStartTimestamp (RHEL-14900) - reposync: Respect --norepopath with --metadata-path (RHEL-40914) - Ensure dns.rdtypes subpackages are available Related: RHEL-32663 - Add missing files due to build change from hatchling to setuptools Related: RHEL-32663 - Rebase to 2.6.1 Resolves: RHEL-32628, RHEL-32663 - Fix build for legacy setup.py Related: rhbz#2177854 - Rebase to version 2.3.0 Resolves: rhbz#2177854 - Remove pycache from patch 0003. Related: rhbz#2107651 - Rebase to version 2.2.1 Resolves: rhbz#2088661 - Disable DNSSEC tests using SHA1 due to crypto policies Resolves: rhbz#2107651 - Rebuild for rhel-9.0 Resolves:rhbz#2040095 - Update to 0.15 Resolves: rhbz#1976102 and rhbz#1977904 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - fix(policy): allow-host-ipv6: allow MLD packets - fix(server): load firewall rules before claiming dbus - fix(nftables): ipset: add entries from GLib loop when idle - fix(systemd): Requires dbus - feat: add iperf{2,3} services - fix(policy): rich: verify ipset exists - fix(systemd): allow start code 251 (RUNNING_BUT_FAILED) - fix(fw): start: remove ipset probe - fix(systemd): verify firewalld is responsive to dbus - test: add scale keyword to scale tests - test(functions): fix iptables normalization for opt field - feat(service): (x)rootd file server - fix(zone): forward: support timeout - fix(policy): support timeouts - fix(policy): allow-host-ipv6: allow MLD packets - fix(server): load firewall rules before claiming dbus - fix(nftables): ipset: add entries from GLib loop when idle - fix(systemd): Requires dbus - feat: add iperf{2,3} services - fix(policy): rich: verify ipset exists - fix(systemd): allow start code 251 (RUNNING_BUT_FAILED) - fix(fw): start: remove ipset probe - fix(systemd): verify firewalld is responsive to dbus - test: add scale keyword to scale tests - test(functions): fix iptables normalization for opt field - fix(policy): use PK_ACTION_CONFIG for set{ZoneSettings2,PolicySettings} (CVE-2026-4948) - fix(zone): forward: support timeout - fix(policy): support timeouts - fix(policy): allow-host-ipv6: allow MLD packets - fix(server): load firewall rules before claiming dbus - fix(nftables): ipset: add entries from GLib loop when idle - fix(systemd): Requires dbus - feat: add iperf{2,3} services - fix(policy): rich: verify ipset exists - fix(systemd): allow start code 251 (RUNNING_BUT_FAILED) - fix(fw): start: remove ipset probe - fix(systemd): verify firewalld is responsive to dbus - test: add scale keyword to scale tests - Fix the multilib problems by backporting fixes done by mhroncok from Fedora: - Move pure Python modules to a noarch subpackage - Ensure Python bytecode installed in multilib packages is bit-to-bit identical Resolves: rhbz#1915764 - Rebuilt for libffi 3.4.2 SONAME transition. Related: rhbz#1891914 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add concurrency fix Related: #1957130 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 3.40.1 - Update to 3.40.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Explicity BuildRequire python3-setuptools - Update to 3.38.0 - Fix the multilib problems by backporting fixes done by mhroncok from Fedora: - Move pure Python modules to a noarch subpackage - Ensure Python bytecode installed in multilib packages is bit-to-bit identical Resolves: rhbz#1915764 - Rebuilt for libffi 3.4.2 SONAME transition. Related: rhbz#1891914 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add concurrency fix Related: #1957130 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 3.40.1 - Update to 3.40.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Explicity BuildRequire python3-setuptools - Update to 3.38.0 - Rebuild Resolves: #2035319 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fix license and covscan issues Resolves: #1938732 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Added patch for almalinux bugtracker - Fix a crash when parsing multiple key files fails (RHEL-145618) - Mark all protected packages as user installed for all transactions (RHEL-76112) - Add `filterUnneededExtraUserinstalled` and Python version to the API - Describe all problems even when there are protected removals (RHEL-115194) - Clearer error for protected package broken dependencies - Fix comparison of RPM items in the transaction (RHEL-81779) - Introduce $releasever_major, $releasever_minor variables, shell-style variable substitution (RHEL-95006) - history DB: Add "persistence" column (RHEL-100623) - conf: Add bootc_unsafe_paths (RHEL-100622) - module: Warn if module config file is inaccessible (RHEL-62833) - Add persistence configuration option (RHEL-78024) - Do not set a default SELinux creation context if SELinux appears to be disabled (RHEL-43232) - Fix reinstalling packages which conflicts with themselves in dnf_transaction_commit() (RHEL-1454) - Fix calculating a difference between two same-version RPM transacations (RHEL-17494) - Security fix for CVE-2024-3651 Resolves: RHEL-33464 - Security fix for CVE-2026-45409 Resolves: RHEL-215653 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Subpackage python2-iniparse has been removed See https://fedoraproject.org/wiki/Changes/RetirePython2 - Rebuilt for Python 3.8.0rc1 (#1748018) - Drop build dependency on python2-test - Rebuilt for Python 3.8 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Subpackages python2-inotify, python2-inotify-examples have been removed See https://fedoraproject.org/wiki/Changes/RetirePython2 - Rebuilt for Python 3.8.0rc1 (#1748018) - Rebuilt for Python 3.8 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for Python 3.8.0rc1 (#1748018) - Rebuilt for Python 3.8 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - Update to 0.1.18 - Don't print empty requires - Remove Python 2 support - Fix issues detected by static analyzers - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update to 0.1.16 - Fix a crash when clearing COMPS_ObjRTree (RhBug:1888343) - Fix memory leaks and resource leaks - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - spec: Fix building with new cmake macros - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Added patch for almalinux bugtracker - Fix a crash when parsing multiple key files fails (RHEL-145618) - Mark all protected packages as user installed for all transactions (RHEL-76112) - Add `filterUnneededExtraUserinstalled` and Python version to the API - Describe all problems even when there are protected removals (RHEL-115194) - Clearer error for protected package broken dependencies - Fix comparison of RPM items in the transaction (RHEL-81779) - Introduce $releasever_major, $releasever_minor variables, shell-style variable substitution (RHEL-95006) - history DB: Add "persistence" column (RHEL-100623) - conf: Add bootc_unsafe_paths (RHEL-100622) - module: Warn if module config file is inaccessible (RHEL-62833) - Add persistence configuration option (RHEL-78024) - Do not set a default SELinux creation context if SELinux appears to be disabled (RHEL-43232) - Fix reinstalling packages which conflicts with themselves in dnf_transaction_commit() (RHEL-1454) - Fix calculating a difference between two same-version RPM transacations (RHEL-17494) - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Rebase to 1.19.0 (RHEL-62033) - Propagate return value from prepare_repo_download_targets (RHEL-85607) - Security fix for CVE-2026-15308 Resolves: RHEL-193786 - Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+ Resolves: RHEL-194207 - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-167919, RHEL-168161 - Security fix for CVE-2026-4519 Resolves: RHEL-158117 - Rebuilding previous fixes for different build target Related: RHEL-143117, RHEL-143174, RHEL-144897 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143117 Resolves: RHEL-143174 Resolves: RHEL-144897 - Security fix for CVE-2025-12084 Resolves: RHEL-135897 - Move _sysconfigdata_d_linux*.py to the debug subpackage - Update to Python 3.9.25 - Update to Python 3.9.24 - Security fix for CVE-2026-11940 Resolves: RHEL-227228 - Security fix for CVE-2026-15308 Resolves: RHEL-193786 - Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+ Resolves: RHEL-194207 - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-167919, RHEL-168161 - Security fix for CVE-2026-4519 Resolves: RHEL-158117 - Rebuilding previous fixes for different build target Related: RHEL-143117, RHEL-143174, RHEL-144897 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143117 Resolves: RHEL-143174 Resolves: RHEL-144897 - Security fix for CVE-2025-12084 Resolves: RHEL-135897 - Move _sysconfigdata_d_linux*.py to the debug subpackage - Update to Python 3.9.25 - CVE-2026-19553 python3.9: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() Resolves: RHEL-274143 - CVE-2026-19445 python3.9: Use-after-free of a server-side SSLContext when sni_callback switches contexts Resolves: RHEL-276263 - CVE-2026-12345 python3.9: python: Arbitrary file deletion via race condition during temporary directory cleanup Resolves: RHEL-272937 - Security fix for CVE-2026-11940 Resolves: RHEL-227228 - Security fix for CVE-2026-15308 Resolves: RHEL-193786 - Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+ Resolves: RHEL-194207 - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-167919, RHEL-168161 - Security fix for CVE-2026-4519 Resolves: RHEL-158117 - Rebuilding previous fixes for different build target Related: RHEL-143117, RHEL-143174, RHEL-144897 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143117 Resolves: RHEL-143174 Resolves: RHEL-144897 - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-167919, RHEL-168161 - Security fix for CVE-2026-4519 Resolves: RHEL-158117 - Rebuilding previous fixes for different build target Related: RHEL-143117, RHEL-143174, RHEL-144897 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143117 Resolves: RHEL-143174 Resolves: RHEL-144897 - Security fix for CVE-2025-12084 Resolves: RHEL-135897 - Move _sysconfigdata_d_linux*.py to the debug subpackage - Update to Python 3.9.25 - Update to Python 3.9.24 - Security fix for CVE-2025-8194 Resolves: RHEL-106374 - Update to 3.9.23 - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435 Resolves: RHEL-98051, RHEL-98024, RHEL-98242, RHEL-98193, RHEL-98218 - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Rebuilt for the correct target in RHEL (9.7-z) (RHEL-119283) - Fix CVE-2025-9714 (RHEL-119283) - Fix CVE-2025-32415 (RHEL-100182) - Fix CVE-2025-32414 (RHEL-99873) - Fix CVE-2025-7425 (RHEL-102806) - Fix CVE-2025-6021 (RHEL-96507) - Fix CVE-2025-49794 (RHEL-96405) - Fix CVE-2025-49796 (RHEL-96431) - Fix CVE-2025-24928 (RHEL-80142) - Fix CVE-2024-56171 (RHEL-80127) - Fix CVE-2022-49043 (RHEL-76298) - Fix CVE-2024-25062 (RHEL-29196) - Fix CVE-2024-34459 (RHEL-177882) - Rebuilt for the correct target in RHEL (9.7-z) (RHEL-119283) - Fix CVE-2025-9714 (RHEL-119283) - Fix CVE-2025-32415 (RHEL-100182) - Fix CVE-2025-32414 (RHEL-99873) - Fix CVE-2025-7425 (RHEL-102806) - Fix CVE-2025-6021 (RHEL-96507) - Fix CVE-2025-49794 (RHEL-96405) - Fix CVE-2025-49796 (RHEL-96431) - Fix CVE-2025-24928 (RHEL-80142) - Fix CVE-2024-56171 (RHEL-80127) - Fix CVE-2022-49043 (RHEL-76298) - Fix CVE-2025-6170 (RHEL-182016) - Fix CVE-2024-34459 (RHEL-177882) - Rebuilt for the correct target in RHEL (9.7-z) (RHEL-119283) - Fix CVE-2025-9714 (RHEL-119283) - Fix CVE-2025-32415 (RHEL-100182) - Fix CVE-2025-32414 (RHEL-99873) - Fix CVE-2025-7425 (RHEL-102806) - Fix CVE-2025-6021 (RHEL-96507) - Fix CVE-2025-49794 (RHEL-96405) - Fix CVE-2025-49796 (RHEL-96431) - Fix CVE-2025-24928 (RHEL-80142) - Fix CVE-2024-56171 (RHEL-80127) - Fix CVE-2022-49043 (RHEL-76298) - Fix CVE-2026-11979 (RHEL-215568) - Fix CVE-2026-6653 (RHEL-215619) - Fix CVE-2025-6170 (RHEL-182016) - Fix CVE-2024-34459 (RHEL-177882) - Rebuilt for the correct target in RHEL (9.7-z) (RHEL-119283) - Fix CVE-2025-9714 (RHEL-119283) - Fix CVE-2025-32415 (RHEL-100182) - Fix CVE-2025-32414 (RHEL-99873) - Fix CVE-2025-7425 (RHEL-102806) - Fix CVE-2025-6021 (RHEL-96507) - Fix CVE-2025-49794 (RHEL-96405) - Fix CVE-2025-49796 (RHEL-96431) - Fix CVE-2025-24928 (RHEL-80142) - Fix CVE-2026-86144 (RHEL-256304) - Fix CVE-2026-86140 (RHEL-256027) - Fix CVE-2026-74860 (RHEL-256120) - Fix CVE-2026-86142 (RHEL-256365) - Fix CVE-2026-86143 (RHEL-256901) - Fix CVE-2026-86138 (RHEL-256953) - Fix CVE-2026-11979 (RHEL-215568) - Fix CVE-2026-6653 (RHEL-215619) - Fix CVE-2025-6170 (RHEL-182016) - Fix CVE-2024-34459 (RHEL-177882) - Rebuilt for the correct target in RHEL (9.7-z) (RHEL-119283) - Fix CVE-2025-9714 (RHEL-119283) - Fix CVE-2025-32415 (RHEL-100182) - Fix CVE-2025-32414 (RHEL-99873) - Fix CVE-2025-7425 (RHEL-102806) - Fix CVE-2025-6021 (RHEL-96507) - Fix CVE-2025-49794 (RHEL-96405) - Fix CVE-2025-49796 (RHEL-96431) - Update setup.py for older distributions - Use explicit setup.py build commands Resolves: RHEL-119895 - Rebase to upstream python-linux-procfs-0.7.4 Resolves: RHEL-119895 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Apply PR6 by Igor Raits <ignatenkobrain@fedoraproject.org>: Support for building on EPEL8 + upstream tests invocation. - Remove unused BR on python3-tidy (we'd need pytidylib instead, which doesn't seem to be packaged). - Update to 3.3.4. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 3.3.3. - Update to 3.3.2. - Update to 3.3.1. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Fix CVE-2025-69534 (RHEL-153747) - Revert doc/ part of "exthdr: add boolean DCCP option matching" (Phil Sutter) [RHEL-126817] - Revert doc/ part of "meta: introduce meta broute support" (Phil Sutter) [RHEL-126817] - Revert doc/ part of "src: add tcp option reset support" (Phil Sutter) [RHEL-126817] - spec: Update expected test suite results (Phil Sutter) [RHEL-126817] - tests: py: missing json output in never merge across non-expression statements (Phil Sutter) [RHEL-114095] - tests: py: add missing json.output data (Phil Sutter) [RHEL-114095] - tests: py: remove huge-limit test cases (Phil Sutter) [RHEL-114095] - datatype: rt_symbol_table_init() to search for iproute2 configs (Phil Sutter) [RHEL-114095] - tests: shell: connect chains to hook point (Phil Sutter) [RHEL-114095] - tests: shell: Fix sets/reset_command_0 for current kernels (Phil Sutter) [RHEL-114095] - parser_json: fix handle memleak from error path (Phil Sutter) [RHEL-88181] - json: deal appropriately with multidevice in chain (Phil Sutter) [RHEL-88181] - cache: Always set NFT_CACHE_TERSE for list cmd with --terse (Phil Sutter) [RHEL-45633] - Add support for table's persist flag (Phil Sutter) [RHEL-32122] - src: fix reset element support for interval set type (Phil Sutter) [RHEL-153461] - src: netlink: fix crash when ops doesn't support udata (Phil Sutter) [RHEL-153461] - Revert doc/ part of "exthdr: add boolean DCCP option matching" (Phil Sutter) [RHEL-126817] - Revert doc/ part of "meta: introduce meta broute support" (Phil Sutter) [RHEL-126817] - Revert doc/ part of "src: add tcp option reset support" (Phil Sutter) [RHEL-126817] - spec: Update expected test suite results (Phil Sutter) [RHEL-126817] - tests: py: missing json output in never merge across non-expression statements (Phil Sutter) [RHEL-114095] - tests: py: add missing json.output data (Phil Sutter) [RHEL-114095] - tests: py: remove huge-limit test cases (Phil Sutter) [RHEL-114095] - datatype: rt_symbol_table_init() to search for iproute2 configs (Phil Sutter) [RHEL-114095] - tests: shell: connect chains to hook point (Phil Sutter) [RHEL-114095] - tests: shell: Fix sets/reset_command_0 for current kernels (Phil Sutter) [RHEL-114095] - parser_json: fix handle memleak from error path (Phil Sutter) [RHEL-88181] - json: deal appropriately with multidevice in chain (Phil Sutter) [RHEL-88181] - cache: Always set NFT_CACHE_TERSE for list cmd with --terse (Phil Sutter) [RHEL-45633] - Add support for table's persist flag (Phil Sutter) [RHEL-32122] - netlink: add and use nft_data_memcpy helper (Phil Sutter) [RHEL-190549] - spec: Update expected test suite results (Phil Sutter) [RHEL-190549] - tests: monitor: Fix for out-of-path call (Phil Sutter) [RHEL-190549] - tests: monitor: Excercise all syntaxes and variants by default (Phil Sutter) [RHEL-190549] - tests: monitor: Test JSON echo mode as well (Phil Sutter) [RHEL-190549] - tests: monitor: Become $PWD agnostic (Phil Sutter) [RHEL-190549] - tests: monitor: Run in own netns (Phil Sutter) [RHEL-190549] - tests: monitor: Label diffs to help users (Phil Sutter) [RHEL-190549] - tests: monitor: Extend testcases a bit (Phil Sutter) [RHEL-190549] - tests: monitor: enclose device names in quotes (Phil Sutter) [RHEL-190549] - json: Dump flowtable hook spec only if present (Phil Sutter) [RHEL-190549] - tests: py: Fix some JSON equivalents (Phil Sutter) [RHEL-190549] - rule: constify set_is_non_concat_range() (Phil Sutter) [RHEL-190549] - datatype: don't return a const string from cgroupv2_get_path() (Phil Sutter) [RHEL-190549] - tests: py: Fix --keep test runner option (Phil Sutter) [RHEL-190549] - segtree: fix get element command with open intervals (Phil Sutter) [RHEL-190549] - segtree: replace default case by specific types in get_set_intervals() (Phil Sutter) [RHEL-190549] - src: remove EXPR_SET_ELEM in range_expr_value_{low,high}() (Phil Sutter) [RHEL-190549] - segtree: rename set_elem_add() to set_elem_expr_add() (Phil Sutter) [RHEL-190549] - parser_json: fix map/set type confusion crash in map statement parser (Phil Sutter) [RHEL-190549] - cache: honor -c/--check for reset commands (Phil Sutter) [RHEL-190549] - tests: py: osf is ip-only (Phil Sutter) [RHEL-190549] - tests: py: print the file name as intended (Phil Sutter) [RHEL-190549] - tests: py: don't use a fixed filename (Phil Sutter) [RHEL-190549] - mnl: Fix ordering of hooks in 'list hooks' output (Phil Sutter) [RHEL-190549] - segtree: Fix for variable-sized object may not be initialized (Phil Sutter) [RHEL-190549] - cache: Filter for table when listing flowtables (Phil Sutter) [RHEL-190549] - cache: Filter for table when listing sets or maps (Phil Sutter) [RHEL-190549] - cache: Respect family in all list commands (Phil Sutter) [RHEL-190549] - cache: Include chains, flowtables and objects in netlink debug output (Phil Sutter) [RHEL-190549] - cache: Relax chain_cache_dump filter application (Phil Sutter) [RHEL-190549] - parser_bison: add range check for synproxy wscale (Phil Sutter) [RHEL-190549] - json: complete multi-statement set element support (Phil Sutter) [RHEL-190549] - segtree: Fix range aggregation on Big Endian (Phil Sutter) [RHEL-190549] - mergesort: Align concatenation sort order with Big Endian (Phil Sutter) [RHEL-190549] - mergesort: Fix sorting of string values (Phil Sutter) [RHEL-190549] - tests: py: any/tcpopt.t.json: Fix JSON equivalent (Phil Sutter) [RHEL-190549] - expression: expr_build_udata_recurse should recurse (Phil Sutter) [RHEL-190549] - expression: propagate key datatype for anonymous sets (Phil Sutter) [RHEL-190549] - netlink_delinearize: also consider exthdr type when trimming binops (Phil Sutter) [RHEL-190549] - tcpopt: add symbol table for mptcp suboptions (Phil Sutter) [RHEL-190549] - monitor: fix memleak in setelem cb (Phil Sutter) [RHEL-190549] - tests: json_echo: Drop rule handle before multi-add (Phil Sutter) [RHEL-190549] - rule: skip CMD_OBJ_SETELEMS with no elements after set flush (Phil Sutter) [RHEL-190549] - doc: libnftables-json: Describe RULESET object (Phil Sutter) [RHEL-190549] - doc: don't suggest to disable GSO (Phil Sutter) [RHEL-190549] - tests: py: Implement payload_record() (Phil Sutter) [RHEL-190549] - tests: py: inet/osf.t: Fix element ordering in JSON equivalents (Phil Sutter) [RHEL-190549] - tests: py: Do not rely upon '[end]' marker (Phil Sutter) [RHEL-190549] - tests: py: Fix for using wrong payload path (Phil Sutter) [RHEL-190549] - tests: py: any/ct.t.json.output: Drop leftover entry (Phil Sutter) [RHEL-190549] - datatype: Fix boolean type on Big Endian (Phil Sutter) [RHEL-190549] - optimize: Fix verdict expression comparison (Phil Sutter) [RHEL-190549] - src: parser_json: fix format string bugs (Phil Sutter) [RHEL-190549] - doc: fix tcpdump example (Phil Sutter) [RHEL-190549] - tests: py: objects.t: must use input, not output (Phil Sutter) [RHEL-190549] - fib: Fix for existence check on Big Endian (Phil Sutter) [RHEL-190549] - tests: Prepare exit codes for automake (Phil Sutter) [RHEL-190549] - monitor: Inform JSON printer when reporting an object delete event (Phil Sutter) [RHEL-190549] - monitor: Recognize flowtable add/del events (Phil Sutter) [RHEL-190549] - tests: monitor: Fix regex collecting expected echo output (Phil Sutter) [RHEL-190549] - monitor: Quote device names in chain declarations, too (Phil Sutter) [RHEL-190549] - mnl: continue on ENOBUFS errors when processing batch (Phil Sutter) [RHEL-190549] - tests: monitor: Fix for flag arrays in JSON output (Phil Sutter) [RHEL-190549] - mnl: silence compiler warning (Phil Sutter) [RHEL-190549] - fib: restore JSON output for relational expressions (Phil Sutter) [RHEL-190549] - src: ensure chain policy evaluation when specified (Phil Sutter) [RHEL-190549] - segtree: incorrect type when aggregating concatenated set ranges (Phil Sutter) [RHEL-190549] - json: Do not reduce single-item arrays on output (Phil Sutter) [RHEL-190549] - tests: py: Fix tests added for 'icmpv6 taddr' support (Phil Sutter) [RHEL-190549] - tests: py: Drop stale entry from ip/snat.t.payload (Phil Sutter) [RHEL-190549] - tests: py: Drop stale entries from ip6/{ct,meta}.t.json (Phil Sutter) [RHEL-190549] - tests: py: Drop stale entry from ip/snat.t.json (Phil Sutter) [RHEL-190549] - tests: py: Drop duplicate test from inet/vxlan.t (Phil Sutter) [RHEL-190549] - tests: py: Drop stale entry from inet/tcp.t.json (Phil Sutter) [RHEL-190549] - tests: py: Drop duplicate test from inet/gretap.t (Phil Sutter) [RHEL-190549] - tests: py: Drop duplicate test from inet/gre.t (Phil Sutter) [RHEL-190549] - tests: py: Drop duplicate test from inet/geneve.t (Phil Sutter) [RHEL-190549] - tests: py: Drop stale entries since redundant test case removal (Phil Sutter) [RHEL-190549] - src: netlink: netlink_delinearize_table() may return NULL (Phil Sutter) [RHEL-190549] - doc: nft.8: Minor NAT STATEMENTS section review (Phil Sutter) [RHEL-190549] - mnl: Call mnl_attr_nest_end() just once (Phil Sutter) [RHEL-190549] - evaluate: validate set expression type before accessing flags (Phil Sutter) [RHEL-190549] - rule: print chain and flowtable devices in quotes (Phil Sutter) [RHEL-190549] - tests: py: re-enables nft-test.py to load the local nftables.py (Phil Sutter) [RHEL-190549] - fib: allow to use it in set statements (Phil Sutter) [RHEL-190549] - fib: allow to check if route exists in maps (Phil Sutter) [RHEL-190549] - tests: shell: Fix ifname_based_hooks feature check (Phil Sutter) [RHEL-190549] - json: reject too long interface names (Phil Sutter) [RHEL-190549] - tests/py: clean up set backend support fallout (Phil Sutter) [RHEL-190549] - cache: assert name is non-nul when looking up (Phil Sutter) [RHEL-190549] - parser_bison: only reset by name is supported by now (Phil Sutter) [RHEL-190549] - rule: skip fuzzy lookup if object name is not available (Phil Sutter) [RHEL-190549] - parser_bison: allow delete command with map via handle (Phil Sutter) [RHEL-190549] - debug: include kernel set information on cache fill (Phil Sutter) [RHEL-190549] - tests/py: prepare for set debug change (Phil Sutter) [RHEL-190549] - src: BASECHAIN flag no longer implies presence of priority expression (Phil Sutter) [RHEL-190549] - netlink: Avoid crash upon missing NFTNL_OBJ_CT_TIMEOUT_ARRAY attribute (Phil Sutter) [RHEL-190549] - tests: py: Properly fix JSON equivalents for netdev/reject.t (Phil Sutter) [RHEL-190549] - tests: shell: Adjust to ifname-based hooks (Phil Sutter) [RHEL-190549] - tests: shell: combine dormant flag with netdevice removal (Phil Sutter) [RHEL-190549] - tests: monitor: Fix for single flag array avoidance (Phil Sutter) [RHEL-190549] - netlink: Do not allocate a bogus flowtable priority expr (Phil Sutter) [RHEL-190549] - netlink: Fix for potential crash parsing a flowtable (Phil Sutter) [RHEL-190549] - json: work around fuzzer-induced assert crashes (Phil Sutter) [RHEL-190549] - json: prevent null deref if chain->policy is not set (Phil Sutter) [RHEL-190549] - tests: py: fix json single-flag output for fib & synproxy (Phil Sutter) [RHEL-190549] - tests: shell: check for features not available in 5.4 (Phil Sutter) [RHEL-190549] - netlink: Avoid potential NULL-ptr deref parsing set elem expressions (Phil Sutter) [RHEL-190549] - netlink: Catch unknown types when deserializing objects (Phil Sutter) [RHEL-190549] - json: Introduce json_add_array_new() (Phil Sutter) [RHEL-190549] - json: Fix for memleak in __binop_expr_json (Phil Sutter) [RHEL-190549] - json: Accept more than two operands in binary expressions (Phil Sutter) [RHEL-190549] - json: Print single fib flag as non-array (Phil Sutter) [RHEL-190549] - tests: shell: Add test case for JSON 'flags' arrays (Phil Sutter) [RHEL-190549] - json: Print single set flag as non-array (Phil Sutter) [RHEL-190549] - json: Print single synproxy flags as non-array (Phil Sutter) [RHEL-190549] - parser_json: Introduce parse_flags_array() (Phil Sutter) [RHEL-190549] - doc: Fix typo in nat statement 'prefix' description (Phil Sutter) [RHEL-190549] - netlink: bogus concatenated set ranges with netlink message overrun (Phil Sutter) [RHEL-190549] - parser_bison: add selector_expr rule to restrict typeof_expr (Phil Sutter) [RHEL-190549] - optimize: invalidate merge in case of duplicated key in set/map (Phil Sutter) [RHEL-190549] - evaluate: bail out if ct saddr/daddr dependency cannot be inserted (Phil Sutter) [RHEL-190549] - parser_json: bail out on malformed statement in set (Phil Sutter) [RHEL-190549] - parser_json: reject empty jump/goto chain (Phil Sutter) [RHEL-190549] - parser_json: allow statement stateful statement only in set elements (Phil Sutter) [RHEL-190549] - cache: prevent possible crash rule filter is NULL (Phil Sutter) [RHEL-190549] - optimize: expand expression list when merging into concatenation (Phil Sutter) [RHEL-190549] - cache: don't crash when filter is NULL (Phil Sutter) [RHEL-190549] - evaluate: only allow stateful statements in set and map definitions (Phil Sutter) [RHEL-190549] - evaluate: compact STMT_F_STATEFUL checks (Phil Sutter) [RHEL-190549] - json: don't BUG when asked to list synproxies (Phil Sutter) [RHEL-190549] - optimize: incorrect comparison for reject statement (Phil Sutter) [RHEL-190549] - optimize: compact bitmask matching in set/map (Phil Sutter) [RHEL-190549] - tests: shell: missing ct count elements in new set_stmt test (Phil Sutter) [RHEL-190549] - evaluate: don't update cache for anonymous chains (Phil Sutter) [RHEL-190549] - json: make sure timeout list is initialised (Phil Sutter) [RHEL-190549] - parser_bison: consolidate connlimit grammar rule for set elements (Phil Sutter) [RHEL-190549] - parser_bison: consolidate last grammar rule for set elements (Phil Sutter) [RHEL-190549] - parser_bison: consolidate quota grammar rule for set elements (Phil Sutter) [RHEL-190549] - parser_bison: consolidate limit grammar rule for set elements (Phil Sutter) [RHEL-190549] - parser_bison: consolidate counter grammar rule for set elements (Phil Sutter) [RHEL-190549] - tests: shell: extend coverage for set element statements (Phil Sutter) [RHEL-190549] - evaluate: fix assertion failure with malformed map definitions (Phil Sutter) [RHEL-190549] - evaluate: don't allow nat map with specified protocol (Phil Sutter) [RHEL-190549] - parser_bison: reject non-serializeable typeof expressions (Phil Sutter) [RHEL-190549] - netlink: fix stack buffer overrun when emitting ranged expressions (Phil Sutter) [RHEL-190549] - src: print set element with multi-word description in single one line (Phil Sutter) [RHEL-190549] - tests: shell: detach synproxy test (Phil Sutter) [RHEL-190549] - src: do not merge a set with a erroneous one (Phil Sutter) [RHEL-190549] - segtree: incomplete output in get element command with maps (Phil Sutter) [RHEL-190549] - evaluate: release existing datatype when evaluating unary expression (Phil Sutter) [RHEL-190549] - segtree: fix string data initialisation (Phil Sutter) [RHEL-190549] - payload: honor inner payload description in payload_expr_cmp() (Phil Sutter) [RHEL-190549] - payload: return early if dependency is not a payload expression (Phil Sutter) [RHEL-190549] - evaluate: optimize zero length range (Phil Sutter) [RHEL-190549] - fib: Change data type of fib oifname to "ifname" (Phil Sutter) [RHEL-190549] - evaluate: auto-merge is only available for singleton interval sets (Phil Sutter) [RHEL-190549] - parser_bison: compact and simplify list and reset syntax (Phil Sutter) [RHEL-190549] - parser_bison: turn redundant ip option type field match into boolean (Phil Sutter) [RHEL-190549] - datatype: clamp boolean value to 0 and 1 (Phil Sutter) [RHEL-190549] - tests: shell: delete netdev chain after test (Phil Sutter) [RHEL-190549] - ipopt: use ipv4 address datatype for address field in ip options (Phil Sutter) [RHEL-190549] - netlink_delinarize: fix bogus munging of mask value (Phil Sutter) [RHEL-190549] - evaluate: remove variable shadowing (Phil Sutter) [RHEL-190549] - intervals: do not merge intervals with different timeout (Phil Sutter) [RHEL-190549] - src: add EXPR_RANGE_VALUE expression and use it (Phil Sutter) [RHEL-190549] - intervals: add helper function to set previous element (Phil Sutter) [RHEL-190549] - parser_bison: fix UaF when reporting table parse error (Phil Sutter) [RHEL-190549] - intervals: set internal element location with the deletion trigger (Phil Sutter) [RHEL-190549] - optimize: compare expression length (Phil Sutter) [RHEL-190549] - tests: py: Fix for storing payload into missing file (Phil Sutter) [RHEL-190549] - json: Support typeof in set and map types (Phil Sutter) [RHEL-190549] - json: collapse set element commands from parser (Phil Sutter) [RHEL-190549] - doc: extend description of fib expression (Phil Sutter) [RHEL-190549] - tests: monitor: fix up test case breakage (Phil Sutter) [RHEL-190549] - src: fix extended netlink error reporting with large set elements (Phil Sutter) [RHEL-190549] - mnl: rename to mnl_seqnum_alloc() to mnl_seqnum_inc() (Phil Sutter) [RHEL-190549] - mnl: update cmd_add_loc() to take struct nlmsghdr (Phil Sutter) [RHEL-190549] - rule: netlink attribute offset is uint32_t for struct nlerr_loc (Phil Sutter) [RHEL-190549] - src: collapse set element commands from parser (Phil Sutter) [RHEL-190549] - libnftables-json: fix raw payload expression documentation (Phil Sutter) [RHEL-190549] - cache: initialize filter when fetching implicit chains (Phil Sutter) [RHEL-190549] - tests: py: fix up udp csum fixup output (Phil Sutter) [RHEL-190549] - proto: use NFT_PAYLOAD_L4CSUM_PSEUDOHDR flag to mangle UDP checksum (Phil Sutter) [RHEL-190549] - tests: shell: stabilize packetpath/payload (Phil Sutter) [RHEL-190549] - libnftables: Zero ctx->vars after freeing it (Phil Sutter) [RHEL-190549] - cache: position does not require full cache (Phil Sutter) [RHEL-190549] - cache: relax requirement for replace rule command (Phil Sutter) [RHEL-190549] - cache: remove full cache requirement when echo flag is set on (Phil Sutter) [RHEL-190549] - cache: assert filter when calling nft_cache_evaluate() (Phil Sutter) [RHEL-190549] - cache: consolidate reset command (Phil Sutter) [RHEL-190549] - cache: add filtering support for objects (Phil Sutter) [RHEL-190549] - cache: only dump rules for the given table (Phil Sutter) [RHEL-190549] - cache: accumulate flags in batch (Phil Sutter) [RHEL-190549] - cache: reset filter for each command (Phil Sutter) [RHEL-190549] - parser_json: fix several expression memleaks from error path (Phil Sutter) [RHEL-190549] - parser_json: release buffer returned by json_dumps (Phil Sutter) [RHEL-190549] - json: Support maps with concatenated data (Phil Sutter) [RHEL-190549] - parser_json: fix crash in json_parse_set_stmt_list (Phil Sutter) [RHEL-190549] - parser_bison: allow 0 burst in limit rate byte mode (Phil Sutter) [RHEL-190549] - datatype: improve error reporting when time unit is not correct (Phil Sutter) [RHEL-190549] - cache: rule by index requires full cache (Phil Sutter) [RHEL-190549] - datatype: reject rate in quota statement (Phil Sutter) [RHEL-190549] - optimize: skip variables in nat statements (Phil Sutter) [RHEL-190549] - parser_json: use stdin buffer if available (Phil Sutter) [RHEL-190549] - libnftables: skip useable checks for /dev/stdin (Phil Sutter) [RHEL-190549] - optimize: clone counter before insertion into set element (Phil Sutter) [RHEL-190549] - segtree: set on EXPR_F_KERNEL flag for catchall elements in the cache (Phil Sutter) [RHEL-190549] - evaluate: set on expr->len for catchall set elements (Phil Sutter) [RHEL-190549] - parser_bison: recursive table declaration in deprecated meter statement (Phil Sutter) [RHEL-190549] - intervals: fix element deletions with maps (Phil Sutter) [RHEL-190549] - src: add string preprocessor and use it for log prefix string (Phil Sutter) [RHEL-190549] - tests: shell: skip ip option tests if kernel does not support it (Phil Sutter) [RHEL-190549] - cmd: skip variable set elements when collapsing commands (Phil Sutter) [RHEL-190549] - cmd: provide better hint if chain is already declared with different type/hook/priority (Phil Sutter) [RHEL-190549] - monitor: too large shift exponent displaying payload expression (Phil Sutter) [RHEL-190549] - scanner: inet_pton() allows for broader IPv4-Mapped IPv6 addresses (Phil Sutter) [RHEL-190549] - evaluate: Fix incorrect checking the `base` variable in case of IPV6 (Phil Sutter) [RHEL-190549] - evaluate: bogus protocol conflicts in vlan with implicit dependencies (Phil Sutter) [RHEL-190549] - cache: check for NFT_CACHE_REFRESH in current requested cache too (Phil Sutter) [RHEL-190549] - doc: nft.8: Fix markup in ct expectation synopsis (Phil Sutter) [RHEL-190549] - mergesort: Avoid accidental set element reordering (Phil Sutter) [RHEL-190549] - doc: nft.8: Two minor synopsis fixups (Phil Sutter) [RHEL-190549] - tests: shell: check for reset tcp options support (Phil Sutter) [RHEL-190549] - tests: shell: payload matching requires egress support (Phil Sutter) [RHEL-190549] - tests: py: complete icmp and icmpv6 update (Phil Sutter) [RHEL-190549] - src: disentangle ICMP code types (Phil Sutter) [RHEL-190549] - evaluate: display "Range negative size" error (Phil Sutter) [RHEL-190549] - netlink_delinearize: restore binop syntax when listing ruleset for flags (Phil Sutter) [RHEL-190549] - doc: libnftables-json: Drop invalid ops from match expression (Phil Sutter) [RHEL-190549] - parser: json: Support for synproxy objects (Phil Sutter) [RHEL-190549] - tests: py: add payload merging test cases (Phil Sutter) [RHEL-190549] - nftables: do mot merge payloads on negation (Phil Sutter) [RHEL-190549] - rule: fix ASAN errors in chain priority to textual names (Phil Sutter) [RHEL-190549] - parser: compact type/typeof set rules (Phil Sutter) [RHEL-190549] - parser: compact interval typeof rules (Phil Sutter) [RHEL-190549] - src: improve error reporting for destroy command (Phil Sutter) [RHEL-190549] - tests: shell: permit use of host-endian constant values in set lookup keys (Phil Sutter) [RHEL-190549] - evaluate: permit use of host-endian constant values in set lookup keys (Phil Sutter) [RHEL-190549] - expression: missing line in describe command with invalid expression (Phil Sutter) [RHEL-190549] - netlink_delinearize: move concat and value postprocessing to helpers (Phil Sutter) [RHEL-190549] - evaluate: skip byteorder conversion for selector smaller than 2 bytes (Phil Sutter) [RHEL-190549] - cache: Optimize caching for 'list tables' command (Phil Sutter) [RHEL-190549] - evaluate: fix check for unknown in cmd_op_to_name (Phil Sutter) [RHEL-190549] - evaluate: don't assert on net/transport header conflict (Phil Sutter) [RHEL-190549] - json: Support sets' auto-merge option (Phil Sutter) [RHEL-190549] - rule: fix sym refcount assertion (Phil Sutter) [RHEL-190549] - evaluate: error out when store needs more than one 128bit register of align fixup (Phil Sutter) [RHEL-190549] - evaluate: do not fetch next expression on runaway number of concatenation components (Phil Sutter) [RHEL-190549] - evaluate: skip anonymous set optimization for concatenations (Phil Sutter) [RHEL-190549] - evaluate: add missing range checks for dup,fwd and payload statements (Phil Sutter) [RHEL-190549] - doc: incorrect datatype description for icmpv6_type and icmpvx_code (Phil Sutter) [RHEL-190549] - tests: shell: prefer project nft to system-wide nft (Phil Sutter) [RHEL-190549] - parser_bison: ensure all timeout policy names are released (Phil Sutter) [RHEL-190549] - netlink: fix stack overflow due to erroneous rounding (Phil Sutter) [RHEL-190549] - parser_bison: error out on duplicated type/typeof/element keywords (Phil Sutter) [RHEL-190549] - tests: shell: add test to cover payload transport match and mangle (Phil Sutter) [RHEL-190549] - evaluate: fix stack overflow with huge priority string (Phil Sutter) [RHEL-190549] - src: reject large raw payload and concat expressions (Phil Sutter) [RHEL-190549] - evaluate: exthdr: statement arg must be not be a range (Phil Sutter) [RHEL-190549] - meta: fix tc classid parsing out-of-bounds access (Phil Sutter) [RHEL-190549] - parser_bison: close chain scope before chain release (Phil Sutter) [RHEL-190549] - evaluate: fix bogus assertion failure with boolean datatype (Phil Sutter) [RHEL-190549] - parser_bison: fix objref statement corruption (Phil Sutter) [RHEL-190549] - tests: py: missing json output in meta.t with vlan mapping (Phil Sutter) [RHEL-190549] - evaluate: reset statement length context before evaluating statement (Phil Sutter) [RHEL-190549] - parser: tcpopt: fix tcp option parsing with NUM + length field (Phil Sutter) [RHEL-190549] - evaluate: reject set definition with no key (Phil Sutter) [RHEL-190549] - monitor: add support for concatenated set ranges (Phil Sutter) [RHEL-190549] - evaluate: disable meta set with ranges (Phil Sutter) [RHEL-190549] - evaluate: prevent assert when evaluating very large shift values (Phil Sutter) [RHEL-190549] - evaluate: reject sets with no key (Phil Sutter) [RHEL-190549] - evaluate: clone unary expression datatype to deal with dynamic datatype (Phil Sutter) [RHEL-190549] - tests: shell: split nat inet tests (Phil Sutter) [RHEL-190549] - evaluate: bogus error when adding devices to flowtable (Phil Sutter) [RHEL-190549] - tests: shell: flush connlimit sets (Phil Sutter) [RHEL-190549] - tests: shell: adjust add-after-delete flowtable for older kernels (Phil Sutter) [RHEL-190549] - evaluate: fix rule replacement with anon sets (Phil Sutter) [RHEL-190549] - tests: shell: skip if kernel does not support flowtable counter (Phil Sutter) [RHEL-190549] - tests: shell: restore pipapo and chain binding coverage in standalone 30s-stress (Phil Sutter) [RHEL-190549] - json: fix use after free in table_flags_json() (Phil Sutter) [RHEL-190549] - src: expand create commands (Phil Sutter) [RHEL-190549] - tests: shell: split set NAT interval test (Phil Sutter) [RHEL-190549] - tests: shell: split merge nat optimization in two tests (Phil Sutter) [RHEL-190549] - netlink: fix buffer size for user data in netlink_delinearize_chain() (Phil Sutter) [RHEL-190549] - src: remove xfree() and use plain free() (Phil Sutter) [RHEL-190549] - src: add free_const() and use it instead of xfree() (Phil Sutter) [RHEL-190549] - evaluate: place byteorder conversion before rshift in payload expressions (Phil Sutter) [RHEL-190549] - evaluate: reset statement length context only for set mappings (Phil Sutter) [RHEL-190549] - meta: fix hour decoding when timezone offset is negative (Phil Sutter) [RHEL-190549] - tproxy: Drop artificial port printing restriction (Phil Sutter) [RHEL-190549] - tests/shell: fix mount command in "test-wrapper.sh" (Phil Sutter) [RHEL-190549] - parser_bison: fix length check for ifname in ifname_expr_alloc() (Phil Sutter) [RHEL-190549] - tests/shell: cover long interface name in "0042chain_variable_0" test (Phil Sutter) [RHEL-190549] - tests/shell: add missing "elem_opts_compat_0.nodump" file (Phil Sutter) [RHEL-190549] - parser_bison: Fix for broken compatibility with older dumps (Phil Sutter) [RHEL-190549] - src: fix reset element support for interval set type (Phil Sutter) [RHEL-153461] - src: netlink: fix crash when ops doesn't support udata (Phil Sutter) [RHEL-153461] - Revert doc/ part of "exthdr: add boolean DCCP option matching" (Phil Sutter) [RHEL-126817] - Revert doc/ part of "meta: introduce meta broute support" (Phil Sutter) [RHEL-126817] - Revert doc/ part of "src: add tcp option reset support" (Phil Sutter) [RHEL-126817] - spec: Update expected test suite results (Phil Sutter) [RHEL-126817] - tests: py: missing json output in never merge across non-expression statements (Phil Sutter) [RHEL-114095] - tests: py: add missing json.output data (Phil Sutter) [RHEL-114095] - tests: py: remove huge-limit test cases (Phil Sutter) [RHEL-114095] - datatype: rt_symbol_table_init() to search for iproute2 configs (Phil Sutter) [RHEL-114095] - tests: shell: connect chains to hook point (Phil Sutter) [RHEL-114095] - tests: shell: Fix sets/reset_command_0 for current kernels (Phil Sutter) [RHEL-114095] - parser_json: fix handle memleak from error path (Phil Sutter) [RHEL-88181] - json: deal appropriately with multidevice in chain (Phil Sutter) [RHEL-88181] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - adding workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1914843 - while we wait for upstream fix: https://github.com/pexpect/pexpect/issues/669 - Avoid using bindir macro in BuildRequires - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Fix tests when building under COPR (#1822060) - Update to new upstream release 4.8.0 and re-enable tests (#1793613) - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Remove Python2 packaging - Rebuilt for Python 3.8 - Bump epoch for the virtual pip Provide, for this package to take precedence over python3.14-pip Resolves: RHEL-178095 - Add automatically generated Obsoletes tag with the python39- prefix for smoother upgrade from RHEL8 - Related: rhbz#1990421 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Extract and ship license file (#1912893) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Subpackage python2-ptyprocess has been removed See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal - Rebuilt for Python 3.8 - Fix FTBFS - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - Add automatically generated Obsoletes tag with the python39- prefix for smoother upgrade from RHEL8 - Related: rhbz#1990421 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 2.20 (#1810349) - Rebuilt for Python 3.9 - Add gating configuration and a simple smoke test - Related: rhbz#1950291 - Add automatically generated Obsoletes tag with the python39- prefix for smoother upgrade from RHEL8 - Related: rhbz#1990421 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fix licence for examples shipped in pyparsing-doc - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Bootstrap for Python 3.9 - Update to 2.4.7 (#1821085) - Add gating configuration and a simple smoke test - Related: rhbz#1950291 - Add automatically generated Obsoletes tag with the python39- prefix for smoother upgrade from RHEL8 - Related: rhbz#1990421 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Bootstrap for Python 3.9 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - New upstream version - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for Python 3.8.0rc1 (#1748018) - Rebuilt for Python 3.8 - Remove some outdated Obsoletes and Provides, but keep providing python3-yaml and python3-PyYAML for users - Related: rhbz#1990421 - Add automatically generated Obsoletes tag with the python39- prefix for smoother upgrade from RHEL8 - Related: rhbz#1990421 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream release 5.4.1 (rhbz#1918523) - New upstream release 5.4 - Fixes CVE-2020-14343 - New upstream beta release 5.4b2 (rhbz#1916496) - New upstream beta release 5.4b1 (rhbz#1916034) - Disable Python 2 build on RHEL 9+ - Security fix for CVE-2024-47081 Resolves: RHEL-105461 - Security fix for CVE-2024-35195 Resolves: RHEL-37609 - Add support for IPv6 CIDR in no_proxy setting Resolves: RHEL-17548 - Improve error handling on keystore load (RHEL-114837) - Sort files before passing to file attr dependency generators (RHEL-95376) - Allow an optional "override clock" for deterministic timestamps (RHEL-106672) - Add support for spec local file attributes and generators (RHEL-52772) - Store configurable digest(s) on packages in rpmdb (RHEL-35619) - Fix a hard link race condition in brp-strip (RHEL-74011) - Allow parametric macros to opt out of option processing (RHEL-67161) - Report unsafe symlinks during installation as a specific case (RHEL-33393) - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-63070) - Improve newly added %patch warning/error messages (RHEL-6294) - Fix %patch N applying Patch0 implicitly (RHEL-6294) - Issue deprecation warning for number-less %patch (RHEL-6294) - Fix discarded const qualifier in previous patch (RHEL-22607) - Fix root relocation regression (RHEL-28967) - Don't confuse OpenScanHub with false array overrun (RHEL-22607) - Revert incorrect fix for false array overrun (RHEL-22607) - Fix potential use of uninitialized pipe array (RHEL-22604) - Fix potential use of uninitialized pgp struct (RHEL-22605) - Don't confuse OpenScanHub with false array overrun (RHEL-22607) - Add SourceLicense tag to spec syntax (RHEL-28798) - Talk about rpmsign in the rpmsign(8) man page (RHEL-40895) - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - SETools 4.4.4 release - SETools 4.4.3 release - Improve man pages - seinfoflow: Add -r option to get flows into the source type. - seinfoflow.1: Remove references to sepolgen permission map. - AVRule/AVRuleXperm: Treat rules with no permissions as invalid policy. - SELinuxPolicy: Add explicit cast for libspol message - Disable sediff --neverallow and --neverallowxperm options - SETools 4.4.2 release - SETools 4.4.1 release - Update required userspace versions to 3.4 - Drop unnecessary Recommends - Security fix for CVE-2025-47273 Resolves: RHEL-96808 - Make sure the INSTALLER is not pip and remove RECORD - Resolves: RHEL-82609 - Security fix for CVE-2024-6345 Resolves: RHEL-49978 - Security fix for CVE-2025-47273 Resolves: RHEL-96808 - Make sure the INSTALLER is not pip and remove RECORD - Resolves: RHEL-82609 - Security fix for CVE-2024-6345 Resolves: RHEL-49978 - Add gating configuration and simple test - Related: rhbz#1950291 - Add automatically generated Obsoletes tag with the python39- prefix for smoother upgrade from RHEL8 - Related: rhbz#1990421 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Remove python2-six - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Fix compatibility with Python 3.10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 1.15.0 (#1838702) - Rebuilt for Python 3.9 - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Debrand for AlmaLinux - fix: Print list of environments without --set/--list (jhnidek@redhat.com) - RHEL-126157: Update GCP to Google Cloud in log messages (crag@redhat.com) - fix: Update user-facing GCP refrences to Google Cloud (crag@redhat.com) - feat: check if --set arg is empty when the environments module is called (manuelcanorojo@gmail.com) - feat: Added more debug prints to cloud-what (jhnidek@redhat.com) - fix(test): Fix unit test of aws (jhnidek@redhat.com) - fix: Fix getting AWS IMDSv2 signature (jhnidek@redhat.com) - chore: Make new black happy again (jhnidek@redhat.com) - chore: Increased log level of messages (jhnidek@redhat.com) - fix: Use IMDSv2 for signature first (jhnidek@redhat.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Georgian) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Added translation using Weblate (Finnish) (noreply-addon- languages@weblate.org) - fix: TypeError in _get_tls_handshake_info type hinting (macano@redhat.com) - feat: added signature type log in TLS handshake (macano@redhat.com) - feat: added internal method to get tls handshake info (manuelcanorojo@gmail.com) - ci: bump actions/upload-artifact from 5 to 6 (49699333+dependabot[bot]@users.noreply.github.com) - Fix profile upload because of missing self.cp (suttner@atix.de) - Fix upload profile if rhsmcertd is not running at all (suttner@atix.de) - ci: bump actions/checkout from 5 to 6 (49699333+dependabot[bot]@users.noreply.github.com) - Translated using Weblate (Korean) (simmon@nplob.com) - ci: bump actions/upload-artifact from 4 to 5 (49699333+dependabot[bot]@users.noreply.github.com) - feat: [1.29] Added dnf4 warning about skewed clock (jhnidek@redhat.com) - fix: [1.29] Require findutils in .spec file (jhnidek@redhat.com) - ci: bump actions/checkout from 4 to 5 (49699333+dependabot[bot]@users.noreply.github.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Spanish) (fserrador@gmail.com) - Translated using Weblate (Spanish) (jsefler@redhat.com) - Translated using Weblate (Korean) (simmon@nplob.com) - fix: [1.29] Wait random time before reaching IMDS server (jhnidek@redhat.com) - feat: [1.29] Call random.seed() at begining of auto-register (jhnidek@redhat.com) - feat: [1.29] Better control over auto-reg waiting game (jhnidek@redhat.com) - fix: [1.29] Enable content during auto-registration v2 (jhnidek@redhat.com) - Translated using Weblate (Italian) (info@salvatorecocuzza.it) - Translated using Weblate (Italian) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (Italian) (info@salvatorecocuzza.it) - Translated using Weblate (Spanish) (fserrador@gmail.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Chinese (Traditional) (zh_TW)) (chzang55@gmail.com) - Translated using Weblate (Chinese (Simplified) (zh_CN)) (mhorky@redhat.com) - Translated using Weblate (Georgian) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (French) (leane.grasser@proton.me) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (Korean) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (Korean) (noreply-mt-weblate-translation- memory@weblate.org) - Update translation files (noreply@weblate.org) - fix: Handle improperly closed connections (mhorky@redhat.com) - ci: use the right distro for coverage reporting (ptoscano@redhat.com) - New extraction for translatable strings (ptoscano@redhat.com) - Translated using Weblate (Italian) (toscano.pino@tiscali.it) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (French) (leane.grasser@proton.me) - tests: fix mocking of get_terminal_width() in TestColumnize (ptoscano@redhat.com) - feat: print compliance errors & syspurpose status only in entitlement mode (ptoscano@redhat.com) - feat: print "registered" as status when using SCA (ptoscano@redhat.com) - feat: print "not registered" on status when not registered (ptoscano@redhat.com) - tests: force syspurpose tests in test_status to non-SCA (ptoscano@redhat.com) - refactor: move determination of content access mode in own method (ptoscano@redhat.com) - tests: move StubIdentity to stubs (ptoscano@redhat.com) - tests: cleanup dead/broken bits in test_status (ptoscano@redhat.com) - chore: move banner printing to its own function (ptoscano@redhat.com) - fix: Append two additional facts to the graylist (pkoprda@redhat.com) - refactor: Use class constant instead of variable graylist (pkoprda@redhat.com) - fix: Do not upload profile from DNF, when it is disabled in conf (jhnidek@redhat.com) - feat: dnf plugin - outsource uploading of profile to rhsmcertd. (jhnidek@redhat.com) - feat: Enable register with environment names and environment types (jhnidek@redhat.com) - feat: support registering specifying environments with activation keys (ryanverdile@gmail.com) - chore: Remove auto-assign CI job (mhorky@redhat.com) - feat: [1.29] Added basic configuration for Packit (jhnidek@redhat.com) - Revert "feat: Disable anonymous cloud registration temporarily" (ptoscano@redhat.com) - Revert "feat: forcefully switch automatic cloud registration to v1" (ptoscano@redhat.com) - Translated using Weblate (Chinese (Simplified) (zh_CN)) (ptoscano@redhat.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (French) (leane.grasser@proton.me) - Update translation files (noreply@weblate.org) - New extraction for translatable strings (ptoscano@redhat.com) - Translated using Weblate (Italian) (info@salvatorecocuzza.it) - Translated using Weblate (French) (leane.grasser@proton.me) - Translated using Weblate (German) (atalanttore@googlemail.com) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - [1.29] feat/cct-868: Subset of list command options marked as deprecated * Options --available, --all, --ondate, --servicelevel --no-overlap --match- install, --pool-only, --afterdate were marked as deprecated in ListCommand definition of their help string. (mgrunwal@redhat.com) - fix: Handle Retry-After headers better for 429 responses (mhorky@redhat.com) - feat: Better automatic registration logging (mhorky@redhat.com) - fix: perform autoreg waiting when performing standard autoreg (ptoscano@redhat.com) - chore: move autoreg waiting code in own function (ptoscano@redhat.com) - docs: update proxy details in man page (jvlcek@redhat.com) - feat: forcefully switch automatic cloud registration to v1 (ptoscano@redhat.com) - Remove weak dependency on doc subpackage (RHEL-5835) - Rebase to version 2.4.3 - resolves: RHEL-89882 - resolves: RHEL-33758 - Rebase to version 2.4.2 - resolves: RHEL-16479 - Rebase to version 2.4.1 - resolves: rhbz#2190418 - Rebuilt to retrigger brew build - Update to version 1.4.14 - resolves: RHEL-114549 - Update to version 1.4.13 - resolves: RHEL-89880 - Update to version 1.4.12 - resolves: RHEL-59791 - resolves: RHEL-33756 - Rebase to version 1.4.10 - resolves: RHEL-16480 - Rebase to version 1.4.9 - Update to version 0.17.1 - resolves: RHEL-114550 - Update to version 0.16.2 - resolves: RHEL-89881 - resolves: RHEL-33755 - Rebase to version 0.16.1 - resolves: RHEL-16481 - Rebase to version 0.16.0 - Security fix for CVE-2025-66471 - Security fix for CVE-2025-66418 - Security fix for CVE-2026-21441 Resolves: RHEL-139401 - Security fix for CVE-2024-37891 - Backport upstream patch to fix TypeError for http connection if the PoolManager - is instantiated with server_hostname Resolves: RHEL-43172 Resolves: RHEL-39285 - CVE-2026-97687 python-urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override Resolves: RHEL-282326 - CVE-2026-97689 python-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser Resolves: RHEL-282267 - Security fix for CVE-2026-44431 and CVE-2026-44432 Resolves: RHEL-184816, RHEL-185123 - Security fix for CVE-2025-66471 - Security fix for CVE-2025-66418 - Security fix for CVE-2026-21441 Resolves: RHEL-142750, RHEL-139398, RHEL-142767 - Security fix for CVE-2026-44431 and CVE-2026-44432 Resolves: RHEL-184816, RHEL-185123 - Security fix for CVE-2025-66471 - Security fix for CVE-2025-66418 - Security fix for CVE-2026-21441 Resolves: RHEL-142750, RHEL-139398, RHEL-142767 - Security fix for CVE-2024-37891 - Backport upstream patch to fix TypeError for http connection if the PoolManager - is instantiated with server_hostname Resolves: RHEL-43172 Resolves: RHEL-39285 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream release 2.1.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - New upstream release 2.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for Python 3.8.0rc1 (#1748018) - Rebuilt for Python 3.8 - Fix CVE-2026-9323: use cryptographically secure session identifiers in web display module - Resolves: RHEL-212564 - Fix patch application - Related: RHEL-50914 - Fix memory leak - Related: RHEL-50914 - Fix regression - Related: RHEL-50644 - Update to new upstream version - Add tmpfs quota support - Remove rhel-only patches that were merged upstream - Fix patch application - Related: RHEL-50914 - Fix memory leak - Related: RHEL-50914 - Fix regression - Related: RHEL-50644 - Update to new upstream version - Add tmpfs quota support - Remove rhel-only patches that were merged upstream - Rebuilt for gating testing - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Rebase to upstream release v61.0 - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - bump release to rebuild in sidetag - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - bump release to rebuild in sidetag - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Rebase to upstream release v60.0 - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Fix pyverbs tests - Resolves: RHEL-107929, RHEL-107930 - Rebase to upstream release v57.0 - Resolves: RHEL-76570, RHEL-45644, RHEL-72077, RHEL-68506, RHEL-94449 - Fix data corruption in bnxt_re - Resolves: RHEL-89179 - Rebase to upstream release v54.0 - Resolves: RHEL-52886, RHEL-54647, RHEL-51876 - Rebase to upstream release v51.0 - Resolves: RHEL-24473, RHEL-23180 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebase to readline-8.1 Resolves: #1904867 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - version bump - version bump - version bump - netconsole: var/lock -> run/lock - netconsole: source sysconfig/network only if it exists - netconsole: remove unused variables - netconsole: remove trailing whitespaces - sync spec with c9s - rename_device: free path after it is used - rename_device: remove trailing whitespaces - Add -r to while read as per shellcheck - Fix splitting spaces in paths from statetab files - Use make macros https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - migrated to SPDX license - allow multiple names and _srv_ ad_server option Resolves: jira#RHEL-12112 - fix ccache handling for leave operation Resolves: jira#RHEL-5104 - Update to upstream release 0.17.1 Resolves: rhbz#2129050, rhbz#2133839 - rename spec file to restore - add gating.yaml - changes between .47 and .51 had to be stripped due of wrong sync between centos and dist-git - remove dump from RHEL environment - New upstream release 0.4b47 - Update main URL. - Drop dump-glibc_xattr patch, now applied upstream. - Drop documentation conversion from ISO-8859-1 to UTF-8, now applied upstream. - Print correct name of archive table of contents file (#1727392). - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Add make to BuildRequires. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use standard make_build and make_install macros in spec file. - Use library functions for manipulating xattrs (#1795953) - Fix FTBFS by enabling '-fcommon' - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Debrand for AlmaLinux - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558) - timer: rebase last_trigger timestamp if needed (RHEL-118215) - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215) - strv: introduce string_strv_hashmap_remove() (RHEL-14112) - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112) - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112) - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801) - Debrand for AlmaLinux - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - Debrand for AlmaLinux - test: rename the start limit subtest (RHEL-212086) - ci: install GPG keys for Fedora 42 (RHEL-212086) - core: increment start limit counter only when we can start the unit (RHEL-212086) - TEST-07-PID1: wait for systemd-resolved being stopped (RHEL-212086) - test: extend start limit interval (RHEL-212086) - ci: bump the mkosi job to Ubuntu Noble (RHEL-212086) - ci: bump super-linter to v8.7.0 (RHEL-212086) - ci: explicitly disable multi status for Super-Linter (RHEL-212086) - github/linter: disable ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT for super-linter (RHEL-212086) - test: install iscsi-gen-initiatorname from iscsi-initiator-utils (RHEL-212086) - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - new upstream release - drop WITH_SELINUX knob and selinux patches, there's built-in support now - drop several patches which were incorporated upstream, except for changewarnSegv patch (did not apply, and not needed nowadays) - Disable jitter entropy source by default (RHEL-91119) - Add Intel CET IBT instrumentation to assembly code - Update to the upstream v6.17 @ ac43f912 (RHEL-64951) - Update to the upstream v6.16 + tip of origin/master @ 98cf8d63 (RHEL-30953) - Use proper SPDX license identifiers - Fix a test failure - Fix file permissions and do not verify digest, file size and modification time (RHEL-92548) - Comment out empty if clause to prevent shell error (RHEL-58760) - Fix tmpfiles rules (RHEL-58760) - Use tmpfiles.d to create initial /root directory (RHEL-58760) - Fix gating - use explicit script name to run the test - Related: RHEL-7884 - Add support for gating - Related: RHEL-7884 - Fixed a typo in changelog (bz 2115517) - Use %setup -q /usr/bin/cat /builddir/build/SOURCES/rpcbind-1.2.6-double-free.patch | /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch /usr/bin/cat /builddir/build/SOURCES/rpcbind-0.2.3-systemd-envfile.patch | /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch /usr/bin/cat /builddir/build/SOURCES/rpcbind-0.2.3-systemd-tmpfiles.patch | /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch /usr/bin/cat /builddir/build/SOURCES/rpcbind-0.2.4-runstatdir.patch | /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch /usr/bin/cat /builddir/build/SOURCES/rpcbind-1.2.6-systemd-service.patch | /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch /usr/bin/cat /builddir/build/SOURCES/rpcbind-0.2.4-systemd-rundir.patch | /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch - Fixed a double free in init_transport (bz 2115517) - CVE-2026-94640 rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service statistics tracking allows unauthenticated remote denial of service - Resolves: RHEL-266677 - Improve error handling on keystore load (RHEL-114837) - Sort files before passing to file attr dependency generators (RHEL-95376) - Allow an optional "override clock" for deterministic timestamps (RHEL-106672) - Add support for spec local file attributes and generators (RHEL-52772) - Store configurable digest(s) on packages in rpmdb (RHEL-35619) - Fix a hard link race condition in brp-strip (RHEL-74011) - Allow parametric macros to opt out of option processing (RHEL-67161) - Report unsafe symlinks during installation as a specific case (RHEL-33393) - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-63070) - Improve newly added %patch warning/error messages (RHEL-6294) - Fix %patch N applying Patch0 implicitly (RHEL-6294) - Issue deprecation warning for number-less %patch (RHEL-6294) - Fix discarded const qualifier in previous patch (RHEL-22607) - Fix root relocation regression (RHEL-28967) - Don't confuse OpenScanHub with false array overrun (RHEL-22607) - Revert incorrect fix for false array overrun (RHEL-22607) - Fix potential use of uninitialized pipe array (RHEL-22604) - Fix potential use of uninitialized pgp struct (RHEL-22605) - Don't confuse OpenScanHub with false array overrun (RHEL-22607) - Add SourceLicense tag to spec syntax (RHEL-28798) - Talk about rpmsign in the rpmsign(8) man page (RHEL-40895) - Improve error handling on keystore load (RHEL-114837) - Sort files before passing to file attr dependency generators (RHEL-95376) - Allow an optional "override clock" for deterministic timestamps (RHEL-106672) - Add support for spec local file attributes and generators (RHEL-52772) - Store configurable digest(s) on packages in rpmdb (RHEL-35619) - Fix a hard link race condition in brp-strip (RHEL-74011) - Allow parametric macros to opt out of option processing (RHEL-67161) - Report unsafe symlinks during installation as a specific case (RHEL-33393) - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-63070) - Improve newly added %patch warning/error messages (RHEL-6294) - Fix %patch N applying Patch0 implicitly (RHEL-6294) - Issue deprecation warning for number-less %patch (RHEL-6294) - Fix discarded const qualifier in previous patch (RHEL-22607) - Fix root relocation regression (RHEL-28967) - Don't confuse OpenScanHub with false array overrun (RHEL-22607) - Revert incorrect fix for false array overrun (RHEL-22607) - Fix potential use of uninitialized pipe array (RHEL-22604) - Fix potential use of uninitialized pgp struct (RHEL-22605) - Don't confuse OpenScanHub with false array overrun (RHEL-22607) - Add SourceLicense tag to spec syntax (RHEL-28798) - Talk about rpmsign in the rpmsign(8) man page (RHEL-40895) - Improve error handling on keystore load (RHEL-114837) - Sort files before passing to file attr dependency generators (RHEL-95376) - Allow an optional "override clock" for deterministic timestamps (RHEL-106672) - Add support for spec local file attributes and generators (RHEL-52772) - Store configurable digest(s) on packages in rpmdb (RHEL-35619) - Fix a hard link race condition in brp-strip (RHEL-74011) - Allow parametric macros to opt out of option processing (RHEL-67161) - Report unsafe symlinks during installation as a specific case (RHEL-33393) - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-63070) - Improve newly added %patch warning/error messages (RHEL-6294) - Fix %patch N applying Patch0 implicitly (RHEL-6294) - Issue deprecation warning for number-less %patch (RHEL-6294) - Fix discarded const qualifier in previous patch (RHEL-22607) - Fix root relocation regression (RHEL-28967) - Don't confuse OpenScanHub with false array overrun (RHEL-22607) - Revert incorrect fix for false array overrun (RHEL-22607) - Fix potential use of uninitialized pipe array (RHEL-22604) - Fix potential use of uninitialized pgp struct (RHEL-22605) - Don't confuse OpenScanHub with false array overrun (RHEL-22607) - Add SourceLicense tag to spec syntax (RHEL-28798) - Talk about rpmsign in the rpmsign(8) man page (RHEL-40895) - Improve error handling on keystore load (RHEL-114837) - Sort files before passing to file attr dependency generators (RHEL-95376) - Allow an optional "override clock" for deterministic timestamps (RHEL-106672) - Add support for spec local file attributes and generators (RHEL-52772) - Store configurable digest(s) on packages in rpmdb (RHEL-35619) - Fix a hard link race condition in brp-strip (RHEL-74011) - Allow parametric macros to opt out of option processing (RHEL-67161) - Report unsafe symlinks during installation as a specific case (RHEL-33393) - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-63070) - Improve newly added %patch warning/error messages (RHEL-6294) - Fix %patch N applying Patch0 implicitly (RHEL-6294) - Issue deprecation warning for number-less %patch (RHEL-6294) - Fix discarded const qualifier in previous patch (RHEL-22607) - Fix root relocation regression (RHEL-28967) - Don't confuse OpenScanHub with false array overrun (RHEL-22607) - Revert incorrect fix for false array overrun (RHEL-22607) - Fix potential use of uninitialized pipe array (RHEL-22604) - Fix potential use of uninitialized pgp struct (RHEL-22605) - Don't confuse OpenScanHub with false array overrun (RHEL-22607) - Add SourceLicense tag to spec syntax (RHEL-28798) - Talk about rpmsign in the rpmsign(8) man page (RHEL-40895) - Improve error handling on keystore load (RHEL-114837) - Sort files before passing to file attr dependency generators (RHEL-95376) - Allow an optional "override clock" for deterministic timestamps (RHEL-106672) - Add support for spec local file attributes and generators (RHEL-52772) - Store configurable digest(s) on packages in rpmdb (RHEL-35619) - Fix a hard link race condition in brp-strip (RHEL-74011) - Allow parametric macros to opt out of option processing (RHEL-67161) - Report unsafe symlinks during installation as a specific case (RHEL-33393) - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-63070) - Improve newly added %patch warning/error messages (RHEL-6294) - Fix %patch N applying Patch0 implicitly (RHEL-6294) - Issue deprecation warning for number-less %patch (RHEL-6294) - Fix discarded const qualifier in previous patch (RHEL-22607) - Fix root relocation regression (RHEL-28967) - Don't confuse OpenScanHub with false array overrun (RHEL-22607) - Revert incorrect fix for false array overrun (RHEL-22607) - Fix potential use of uninitialized pipe array (RHEL-22604) - Fix potential use of uninitialized pgp struct (RHEL-22605) - Don't confuse OpenScanHub with false array overrun (RHEL-22607) - Add SourceLicense tag to spec syntax (RHEL-28798) - Talk about rpmsign in the rpmsign(8) man page (RHEL-40895) - Rebase to 1.10.2 and sequioa-openpgp with fixes for CVE-2026-42784 - Pull PQC crypto to rpm-sequoia - RHEL-9 CI and gating setup - Initial commit on c9s - Pull PQC crypto to rpm-sequoia - RHEL-9 CI and gating setup - Initial commit on c9s - Improve error handling on keystore load (RHEL-114837) - Sort files before passing to file attr dependency generators (RHEL-95376) - Allow an optional "override clock" for deterministic timestamps (RHEL-106672) - Add support for spec local file attributes and generators (RHEL-52772) - Store configurable digest(s) on packages in rpmdb (RHEL-35619) - Fix a hard link race condition in brp-strip (RHEL-74011) - Allow parametric macros to opt out of option processing (RHEL-67161) - Report unsafe symlinks during installation as a specific case (RHEL-33393) - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-63070) - Improve newly added %patch warning/error messages (RHEL-6294) - Fix %patch N applying Patch0 implicitly (RHEL-6294) - Issue deprecation warning for number-less %patch (RHEL-6294) - Fix discarded const qualifier in previous patch (RHEL-22607) - Fix root relocation regression (RHEL-28967) - Don't confuse OpenScanHub with false array overrun (RHEL-22607) - Revert incorrect fix for false array overrun (RHEL-22607) - Fix potential use of uninitialized pipe array (RHEL-22604) - Fix potential use of uninitialized pgp struct (RHEL-22605) - Don't confuse OpenScanHub with false array overrun (RHEL-22607) - Add SourceLicense tag to spec syntax (RHEL-28798) - Talk about rpmsign in the rpmsign(8) man page (RHEL-40895) - Improve error handling on keystore load (RHEL-114837) - Sort files before passing to file attr dependency generators (RHEL-95376) - Allow an optional "override clock" for deterministic timestamps (RHEL-106672) - Add support for spec local file attributes and generators (RHEL-52772) - Store configurable digest(s) on packages in rpmdb (RHEL-35619) - Fix a hard link race condition in brp-strip (RHEL-74011) - Allow parametric macros to opt out of option processing (RHEL-67161) - Report unsafe symlinks during installation as a specific case (RHEL-33393) - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-63070) - Improve newly added %patch warning/error messages (RHEL-6294) - Fix %patch N applying Patch0 implicitly (RHEL-6294) - Issue deprecation warning for number-less %patch (RHEL-6294) - Fix discarded const qualifier in previous patch (RHEL-22607) - Fix root relocation regression (RHEL-28967) - Don't confuse OpenScanHub with false array overrun (RHEL-22607) - Revert incorrect fix for false array overrun (RHEL-22607) - Fix potential use of uninitialized pipe array (RHEL-22604) - Fix potential use of uninitialized pgp struct (RHEL-22605) - Don't confuse OpenScanHub with false array overrun (RHEL-22607) - Add SourceLicense tag to spec syntax (RHEL-28798) - Talk about rpmsign in the rpmsign(8) man page (RHEL-40895) - Fix integer overflow in compressed-token decoding (CVE-2026-43618) - Resolves: RHEL-174932 - Fix TOCTOU symlink race in daemon no-chroot mode (CVE-2026-29518) - Resolves: RHEL-174952 - Resolves: RHEL-104404 - Do not clear DISPLAY unconditionally - Resolves: RHEL-70265 - Rebase rsync to 3.2.5 - Resolves: RHEL-70158 - Info Leak via Uninitialized Stack Contents - Resolves: RHEL-70208 - Path traversal vulnerability in rsync - Resolves: RHEL-70210 - --safe-links option bypass leads to path traversal - Resolves: RHEL-71657 - Race Condition in rsync Handling Symbolic Links - Resolves: RHEL-70265 - Rebase rsync to 3.2.5 - Resolves: RHEL-67142 - Wrong progress reported by rsync when using copy-devices - Resolves: RHEL-29340 - Slowness in rsync due to extra validation steps. - Resolves: RHEL-18216 - rysnc script /usr/share/doc/rsync/support/rrsync is unsecure - Resolves: RHEL-173468 - CVE-2024-12086 rsync server leaks arbitrary client files - Resolves: RHEL-169151 - CVE-2026-41035 - Use-after-free vulnerability in extended attribute handling - Resolves: RHEL-152536 - CVE-2025-10158 Out of bounds array access via negative index - Resolves: RHEL-104404 - Do not clear DISPLAY unconditionally - Resolves: RHEL-70265 - Rebase rsync to 3.2.5 - Resolves: RHEL-70158 - Info Leak via Uninitialized Stack Contents - Resolves: RHEL-70208 - Path traversal vulnerability in rsync - Resolves: RHEL-70210 - --safe-links option bypass leads to path traversal - Resolves: RHEL-71657 - Race Condition in rsync Handling Symbolic Links - Resolves: RHEL-70265 - Rebase rsync to 3.2.5 - Resolves: RHEL-67142 - Wrong progress reported by rsync when using copy-devices - Resolves: RHEL-29340 - Slowness in rsync due to extra validation steps. - Resolves: RHEL-18216 - rysnc script /usr/share/doc/rsync/support/rrsync is unsecure - Resolves: RHEL-248836 - Rebase rsync to version 3.2.7 in RHEL9 - Fix integer overflow in compressed-token decoding (CVE-2026-43618) - Resolves: RHEL-174932 - Fix TOCTOU symlink race in daemon no-chroot mode (CVE-2026-29518) - Resolves: RHEL-174952 - Resolves: RHEL-104404 - Do not clear DISPLAY unconditionally - Resolves: RHEL-70265 - Rebase rsync to 3.2.5 - Resolves: RHEL-70158 - Info Leak via Uninitialized Stack Contents - Resolves: RHEL-70208 - Path traversal vulnerability in rsync - Resolves: RHEL-70210 - --safe-links option bypass leads to path traversal - Resolves: RHEL-71657 - Race Condition in rsync Handling Symbolic Links - Resolves: RHEL-70265 - Rebase rsync to 3.2.5 - Resolves: RHEL-67142 - Wrong progress reported by rsync when using copy-devices - Resolves: RHEL-29340 - Slowness in rsync due to extra validation steps. - Resolves: RHEL-18216 - rysnc script /usr/share/doc/rsync/support/rrsync is unsecure - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-257111 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180756 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169665 - Fix samba automount triggering for more file systems - resolves: RHEL-169726 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147419 - Fix samba-bgqd to load [printers] share - resolves: RHEL-147858 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144590 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144480 - Update to version 4.23.5 - resolves: RHEL-143401 - Fix winbind group resolution - resolves: RHEL-141027 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-133003 - Update to version 4.23.4 - resolves: RHEL-114548 - Update to version 4.23.4 - resolves: RHEL-132995 - Fix Time Machine backup - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba - lib/dfa.c: Increase the maximum size of the transitions table - After changes introduced between sed 4.2 and 4.4, some regexps started to hit the table size limits. This lead to repeated deletion and rebuilding of the table, leading to massive performance drops. While the core issue is still present, this change should at least help by moving the threshold of the regexp complexity that triggers the table rebuilds. - Resolves: RHEL-144026 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-209599 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-209599 - Rebuild with the target::exception flag Resolves: RHEL-148247 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148247 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146688 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128542 - Add the fs_write_tmpfs_files() interface Resolves: RHEL-142141 - Dontaudit aide the execmem permission Resolves: RHEL-121480 - Update gpg policy for interactions with rhc-playbook-verifier Resolves: RHEL-132748 - Allow rhc_playbook_verifier_t stream connect to itself Resolves: RHEL-132748 - Update policy for rhc-worker-playbook Resolves: RHEL-132748 - Allow traceroute_t bind rawip sockets to unreserved ports Resolves: RHEL-130267 - Revert "Allow traceroute_t bind rawip sockets to unreserved ports" Related: RHEL-130267 - Allow sudodomain connect to gkeyringd over a unix stream socket Resolves: RHEL-121158 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-95985 - Allow ssh_agent_type manage generic cache home files Resolves: RHEL-121165 - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t Resolves: RHEL-121165 - Allow boothd connect to systemd-machined over a unix socket Resolves: RHEL-140882 - Macros: Require only "stable" version of selinux-policy (RHEL-141433) - Add insights_client service interfaces Related: RHEL-140893 - Confine rhc-worker-playbook.worker and rhc-playbook-verifier Resolves: RHEL-132748 - Allow gpg manage rpm cache Related: RHEL-108775 - Allow gpg read rpm cache Related: RHEL-108775 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121480 - Allow rules for confined users logged in plasma Resolves: RHEL-133898 - Allow login_userdomain watch lnk_files in /usr Resolves: RHEL-133898 - Revert "Allow NM nvme dispatcher script start systemd services" Resolves: RHEL-111946 - Allow ssh_agent_type create a sockfile in /run/user/USERID Resolves: RHEL-121936 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-111946 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121480 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129879 - Add the rpm_signal() interface Related: RHEL-108826 - Allow tuned_t use its private tmpfs files Related: RHEL-108826 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-66119 - Allow sysadm access to TPM Resolves: RHEL-119055 - Update policy for dhcpc_hook_t Resolves: RHEL-113941 - Allow stap server read virtual memory sysctls Resolves: RHEL-114157 - Allow login_userdomain watch /home and /var directories Resolves: RHEL-119686 - Allow login_userdomain read lastlog Resolves: RHEL-119686 - Allow staff role read/write cockpit-session unix stream sockets Resolves: RHEL-108068 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113941 - Rebuild with the target::exception flag Resolves: RHEL-148247 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148247 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146688 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128542 - Add the fs_write_tmpfs_files() interface Resolves: RHEL-142141 - Dontaudit aide the execmem permission Resolves: RHEL-121480 - Update gpg policy for interactions with rhc-playbook-verifier Resolves: RHEL-132748 - Allow rhc_playbook_verifier_t stream connect to itself Resolves: RHEL-132748 - Update policy for rhc-worker-playbook Resolves: RHEL-132748 - Allow traceroute_t bind rawip sockets to unreserved ports Resolves: RHEL-130267 - Revert "Allow traceroute_t bind rawip sockets to unreserved ports" Related: RHEL-130267 - Allow sudodomain connect to gkeyringd over a unix stream socket Resolves: RHEL-121158 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-95985 - Allow ssh_agent_type manage generic cache home files Resolves: RHEL-121165 - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t Resolves: RHEL-121165 - Allow boothd connect to systemd-machined over a unix socket Resolves: RHEL-140882 - Macros: Require only "stable" version of selinux-policy (RHEL-141433) - Add insights_client service interfaces Related: RHEL-140893 - Confine rhc-worker-playbook.worker and rhc-playbook-verifier Resolves: RHEL-132748 - Allow gpg manage rpm cache Related: RHEL-108775 - Allow gpg read rpm cache Related: RHEL-108775 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121480 - Allow rules for confined users logged in plasma Resolves: RHEL-133898 - Allow login_userdomain watch lnk_files in /usr Resolves: RHEL-133898 - Revert "Allow NM nvme dispatcher script start systemd services" Resolves: RHEL-111946 - Allow ssh_agent_type create a sockfile in /run/user/USERID Resolves: RHEL-121936 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-111946 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121480 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129879 - Add the rpm_signal() interface Related: RHEL-108826 - Allow tuned_t use its private tmpfs files Related: RHEL-108826 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-66119 - Allow sysadm access to TPM Resolves: RHEL-119055 - Update policy for dhcpc_hook_t Resolves: RHEL-113941 - Allow stap server read virtual memory sysctls Resolves: RHEL-114157 - Allow login_userdomain watch /home and /var directories Resolves: RHEL-119686 - Allow login_userdomain read lastlog Resolves: RHEL-119686 - Allow staff role read/write cockpit-session unix stream sockets Resolves: RHEL-108068 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113941 - Allow insights-client manage /etc symlinks Resolves: RHEL-108826 - Allow insights-client get attributes of the rpm executable Resolves: RHEL-127329 - Allow ras-mc-ctl get attributes of the kmod executable Resolves: RHEL-103975 - Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern Resolves: RHEL-101155 - Allow bootupd delete symlinks in the /boot directory Resolves: RHEL-101155 - Update policy for bootupd Resolves: RHEL-101155 - Allow create kerberos files in postgresql db home Resolves: RHEL-123225 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-209599 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-209599 - Rebuild with the target::exception flag Resolves: RHEL-148247 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148247 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146688 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128542 - Add the fs_write_tmpfs_files() interface Resolves: RHEL-142141 - Dontaudit aide the execmem permission Resolves: RHEL-121480 - Update gpg policy for interactions with rhc-playbook-verifier Resolves: RHEL-132748 - Allow rhc_playbook_verifier_t stream connect to itself Resolves: RHEL-132748 - Update policy for rhc-worker-playbook Resolves: RHEL-132748 - Allow traceroute_t bind rawip sockets to unreserved ports Resolves: RHEL-130267 - Revert "Allow traceroute_t bind rawip sockets to unreserved ports" Related: RHEL-130267 - Allow sudodomain connect to gkeyringd over a unix stream socket Resolves: RHEL-121158 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-95985 - Allow ssh_agent_type manage generic cache home files Resolves: RHEL-121165 - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t Resolves: RHEL-121165 - Allow boothd connect to systemd-machined over a unix socket Resolves: RHEL-140882 - Macros: Require only "stable" version of selinux-policy (RHEL-141433) - Add insights_client service interfaces Related: RHEL-140893 - Confine rhc-worker-playbook.worker and rhc-playbook-verifier Resolves: RHEL-132748 - Allow gpg manage rpm cache Related: RHEL-108775 - Allow gpg read rpm cache Related: RHEL-108775 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121480 - Allow rules for confined users logged in plasma Resolves: RHEL-133898 - Allow login_userdomain watch lnk_files in /usr Resolves: RHEL-133898 - Revert "Allow NM nvme dispatcher script start systemd services" Resolves: RHEL-111946 - Allow ssh_agent_type create a sockfile in /run/user/USERID Resolves: RHEL-121936 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-111946 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121480 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129879 - Add the rpm_signal() interface Related: RHEL-108826 - Allow tuned_t use its private tmpfs files Related: RHEL-108826 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-66119 - Allow sysadm access to TPM Resolves: RHEL-119055 - Update policy for dhcpc_hook_t Resolves: RHEL-113941 - Allow stap server read virtual memory sysctls Resolves: RHEL-114157 - Allow login_userdomain watch /home and /var directories Resolves: RHEL-119686 - Allow login_userdomain read lastlog Resolves: RHEL-119686 - Allow staff role read/write cockpit-session unix stream sockets Resolves: RHEL-108068 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113941 - Rebuild with the target::exception flag Resolves: RHEL-148247 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148247 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146688 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128542 - Add the fs_write_tmpfs_files() interface Resolves: RHEL-142141 - Dontaudit aide the execmem permission Resolves: RHEL-121480 - Update gpg policy for interactions with rhc-playbook-verifier Resolves: RHEL-132748 - Allow rhc_playbook_verifier_t stream connect to itself Resolves: RHEL-132748 - Update policy for rhc-worker-playbook Resolves: RHEL-132748 - Allow traceroute_t bind rawip sockets to unreserved ports Resolves: RHEL-130267 - Revert "Allow traceroute_t bind rawip sockets to unreserved ports" Related: RHEL-130267 - Allow sudodomain connect to gkeyringd over a unix stream socket Resolves: RHEL-121158 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-95985 - Allow ssh_agent_type manage generic cache home files Resolves: RHEL-121165 - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t Resolves: RHEL-121165 - Allow boothd connect to systemd-machined over a unix socket Resolves: RHEL-140882 - Macros: Require only "stable" version of selinux-policy (RHEL-141433) - Add insights_client service interfaces Related: RHEL-140893 - Confine rhc-worker-playbook.worker and rhc-playbook-verifier Resolves: RHEL-132748 - Allow gpg manage rpm cache Related: RHEL-108775 - Allow gpg read rpm cache Related: RHEL-108775 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121480 - Allow rules for confined users logged in plasma Resolves: RHEL-133898 - Allow login_userdomain watch lnk_files in /usr Resolves: RHEL-133898 - Revert "Allow NM nvme dispatcher script start systemd services" Resolves: RHEL-111946 - Allow ssh_agent_type create a sockfile in /run/user/USERID Resolves: RHEL-121936 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-111946 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121480 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129879 - Add the rpm_signal() interface Related: RHEL-108826 - Allow tuned_t use its private tmpfs files Related: RHEL-108826 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-66119 - Allow sysadm access to TPM Resolves: RHEL-119055 - Update policy for dhcpc_hook_t Resolves: RHEL-113941 - Allow stap server read virtual memory sysctls Resolves: RHEL-114157 - Allow login_userdomain watch /home and /var directories Resolves: RHEL-119686 - Allow login_userdomain read lastlog Resolves: RHEL-119686 - Allow staff role read/write cockpit-session unix stream sockets Resolves: RHEL-108068 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113941 - Allow insights-client manage /etc symlinks Resolves: RHEL-108826 - Allow insights-client get attributes of the rpm executable Resolves: RHEL-127329 - Allow ras-mc-ctl get attributes of the kmod executable Resolves: RHEL-103975 - Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern Resolves: RHEL-101155 - Allow bootupd delete symlinks in the /boot directory Resolves: RHEL-101155 - Update policy for bootupd Resolves: RHEL-101155 - Allow create kerberos files in postgresql db home Resolves: RHEL-123225 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-209599 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-209599 - Rebuild with the target::exception flag Resolves: RHEL-148247 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148247 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146688 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128542 - Add the fs_write_tmpfs_files() interface Resolves: RHEL-142141 - Dontaudit aide the execmem permission Resolves: RHEL-121480 - Update gpg policy for interactions with rhc-playbook-verifier Resolves: RHEL-132748 - Allow rhc_playbook_verifier_t stream connect to itself Resolves: RHEL-132748 - Update policy for rhc-worker-playbook Resolves: RHEL-132748 - Allow traceroute_t bind rawip sockets to unreserved ports Resolves: RHEL-130267 - Revert "Allow traceroute_t bind rawip sockets to unreserved ports" Related: RHEL-130267 - Allow sudodomain connect to gkeyringd over a unix stream socket Resolves: RHEL-121158 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-95985 - Allow ssh_agent_type manage generic cache home files Resolves: RHEL-121165 - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t Resolves: RHEL-121165 - Allow boothd connect to systemd-machined over a unix socket Resolves: RHEL-140882 - Macros: Require only "stable" version of selinux-policy (RHEL-141433) - Add insights_client service interfaces Related: RHEL-140893 - Confine rhc-worker-playbook.worker and rhc-playbook-verifier Resolves: RHEL-132748 - Allow gpg manage rpm cache Related: RHEL-108775 - Allow gpg read rpm cache Related: RHEL-108775 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121480 - Allow rules for confined users logged in plasma Resolves: RHEL-133898 - Allow login_userdomain watch lnk_files in /usr Resolves: RHEL-133898 - Revert "Allow NM nvme dispatcher script start systemd services" Resolves: RHEL-111946 - Allow ssh_agent_type create a sockfile in /run/user/USERID Resolves: RHEL-121936 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-111946 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121480 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129879 - Add the rpm_signal() interface Related: RHEL-108826 - Allow tuned_t use its private tmpfs files Related: RHEL-108826 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-66119 - Allow sysadm access to TPM Resolves: RHEL-119055 - Update policy for dhcpc_hook_t Resolves: RHEL-113941 - Allow stap server read virtual memory sysctls Resolves: RHEL-114157 - Allow login_userdomain watch /home and /var directories Resolves: RHEL-119686 - Allow login_userdomain read lastlog Resolves: RHEL-119686 - Allow staff role read/write cockpit-session unix stream sockets Resolves: RHEL-108068 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113941 - Rebuild with the target::exception flag Resolves: RHEL-148247 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148247 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146688 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128542 - Add the fs_write_tmpfs_files() interface Resolves: RHEL-142141 - Dontaudit aide the execmem permission Resolves: RHEL-121480 - Update gpg policy for interactions with rhc-playbook-verifier Resolves: RHEL-132748 - Allow rhc_playbook_verifier_t stream connect to itself Resolves: RHEL-132748 - Update policy for rhc-worker-playbook Resolves: RHEL-132748 - Allow traceroute_t bind rawip sockets to unreserved ports Resolves: RHEL-130267 - Revert "Allow traceroute_t bind rawip sockets to unreserved ports" Related: RHEL-130267 - Allow sudodomain connect to gkeyringd over a unix stream socket Resolves: RHEL-121158 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-95985 - Allow ssh_agent_type manage generic cache home files Resolves: RHEL-121165 - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t Resolves: RHEL-121165 - Allow boothd connect to systemd-machined over a unix socket Resolves: RHEL-140882 - Macros: Require only "stable" version of selinux-policy (RHEL-141433) - Add insights_client service interfaces Related: RHEL-140893 - Confine rhc-worker-playbook.worker and rhc-playbook-verifier Resolves: RHEL-132748 - Allow gpg manage rpm cache Related: RHEL-108775 - Allow gpg read rpm cache Related: RHEL-108775 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121480 - Allow rules for confined users logged in plasma Resolves: RHEL-133898 - Allow login_userdomain watch lnk_files in /usr Resolves: RHEL-133898 - Revert "Allow NM nvme dispatcher script start systemd services" Resolves: RHEL-111946 - Allow ssh_agent_type create a sockfile in /run/user/USERID Resolves: RHEL-121936 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-111946 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121480 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129879 - Add the rpm_signal() interface Related: RHEL-108826 - Allow tuned_t use its private tmpfs files Related: RHEL-108826 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-66119 - Allow sysadm access to TPM Resolves: RHEL-119055 - Update policy for dhcpc_hook_t Resolves: RHEL-113941 - Allow stap server read virtual memory sysctls Resolves: RHEL-114157 - Allow login_userdomain watch /home and /var directories Resolves: RHEL-119686 - Allow login_userdomain read lastlog Resolves: RHEL-119686 - Allow staff role read/write cockpit-session unix stream sockets Resolves: RHEL-108068 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113941 - Allow insights-client manage /etc symlinks Resolves: RHEL-108826 - Allow insights-client get attributes of the rpm executable Resolves: RHEL-127329 - Allow ras-mc-ctl get attributes of the kmod executable Resolves: RHEL-103975 - Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern Resolves: RHEL-101155 - Allow bootupd delete symlinks in the /boot directory Resolves: RHEL-101155 - Update policy for bootupd Resolves: RHEL-101155 - Allow create kerberos files in postgresql db home Resolves: RHEL-123225 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-209599 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-209599 - Rebuild with the target::exception flag Resolves: RHEL-148247 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148247 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146688 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128542 - Add the fs_write_tmpfs_files() interface Resolves: RHEL-142141 - Dontaudit aide the execmem permission Resolves: RHEL-121480 - Update gpg policy for interactions with rhc-playbook-verifier Resolves: RHEL-132748 - Allow rhc_playbook_verifier_t stream connect to itself Resolves: RHEL-132748 - Update policy for rhc-worker-playbook Resolves: RHEL-132748 - Allow traceroute_t bind rawip sockets to unreserved ports Resolves: RHEL-130267 - Revert "Allow traceroute_t bind rawip sockets to unreserved ports" Related: RHEL-130267 - Allow sudodomain connect to gkeyringd over a unix stream socket Resolves: RHEL-121158 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-95985 - Allow ssh_agent_type manage generic cache home files Resolves: RHEL-121165 - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t Resolves: RHEL-121165 - Allow boothd connect to systemd-machined over a unix socket Resolves: RHEL-140882 - Macros: Require only "stable" version of selinux-policy (RHEL-141433) - Add insights_client service interfaces Related: RHEL-140893 - Confine rhc-worker-playbook.worker and rhc-playbook-verifier Resolves: RHEL-132748 - Allow gpg manage rpm cache Related: RHEL-108775 - Allow gpg read rpm cache Related: RHEL-108775 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121480 - Allow rules for confined users logged in plasma Resolves: RHEL-133898 - Allow login_userdomain watch lnk_files in /usr Resolves: RHEL-133898 - Revert "Allow NM nvme dispatcher script start systemd services" Resolves: RHEL-111946 - Allow ssh_agent_type create a sockfile in /run/user/USERID Resolves: RHEL-121936 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-111946 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121480 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129879 - Add the rpm_signal() interface Related: RHEL-108826 - Allow tuned_t use its private tmpfs files Related: RHEL-108826 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-66119 - Allow sysadm access to TPM Resolves: RHEL-119055 - Update policy for dhcpc_hook_t Resolves: RHEL-113941 - Allow stap server read virtual memory sysctls Resolves: RHEL-114157 - Allow login_userdomain watch /home and /var directories Resolves: RHEL-119686 - Allow login_userdomain read lastlog Resolves: RHEL-119686 - Allow staff role read/write cockpit-session unix stream sockets Resolves: RHEL-108068 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113941 - Rebuild with the target::exception flag Resolves: RHEL-148247 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148247 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146688 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128542 - Add the fs_write_tmpfs_files() interface Resolves: RHEL-142141 - Dontaudit aide the execmem permission Resolves: RHEL-121480 - Update gpg policy for interactions with rhc-playbook-verifier Resolves: RHEL-132748 - Allow rhc_playbook_verifier_t stream connect to itself Resolves: RHEL-132748 - Update policy for rhc-worker-playbook Resolves: RHEL-132748 - Allow traceroute_t bind rawip sockets to unreserved ports Resolves: RHEL-130267 - Revert "Allow traceroute_t bind rawip sockets to unreserved ports" Related: RHEL-130267 - Allow sudodomain connect to gkeyringd over a unix stream socket Resolves: RHEL-121158 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-95985 - Allow ssh_agent_type manage generic cache home files Resolves: RHEL-121165 - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t Resolves: RHEL-121165 - Allow boothd connect to systemd-machined over a unix socket Resolves: RHEL-140882 - Macros: Require only "stable" version of selinux-policy (RHEL-141433) - Add insights_client service interfaces Related: RHEL-140893 - Confine rhc-worker-playbook.worker and rhc-playbook-verifier Resolves: RHEL-132748 - Allow gpg manage rpm cache Related: RHEL-108775 - Allow gpg read rpm cache Related: RHEL-108775 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121480 - Allow rules for confined users logged in plasma Resolves: RHEL-133898 - Allow login_userdomain watch lnk_files in /usr Resolves: RHEL-133898 - Revert "Allow NM nvme dispatcher script start systemd services" Resolves: RHEL-111946 - Allow ssh_agent_type create a sockfile in /run/user/USERID Resolves: RHEL-121936 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-111946 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121480 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129879 - Add the rpm_signal() interface Related: RHEL-108826 - Allow tuned_t use its private tmpfs files Related: RHEL-108826 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-66119 - Allow sysadm access to TPM Resolves: RHEL-119055 - Update policy for dhcpc_hook_t Resolves: RHEL-113941 - Allow stap server read virtual memory sysctls Resolves: RHEL-114157 - Allow login_userdomain watch /home and /var directories Resolves: RHEL-119686 - Allow login_userdomain read lastlog Resolves: RHEL-119686 - Allow staff role read/write cockpit-session unix stream sockets Resolves: RHEL-108068 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113941 - Allow insights-client manage /etc symlinks Resolves: RHEL-108826 - Allow insights-client get attributes of the rpm executable Resolves: RHEL-127329 - Allow ras-mc-ctl get attributes of the kmod executable Resolves: RHEL-103975 - Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern Resolves: RHEL-101155 - Allow bootupd delete symlinks in the /boot directory Resolves: RHEL-101155 - Update policy for bootupd Resolves: RHEL-101155 - Allow create kerberos files in postgresql db home Resolves: RHEL-123225 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-209599 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-209599 - Rebuild with the target::exception flag Resolves: RHEL-148247 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148247 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146688 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128542 - Add the fs_write_tmpfs_files() interface Resolves: RHEL-142141 - Dontaudit aide the execmem permission Resolves: RHEL-121480 - Update gpg policy for interactions with rhc-playbook-verifier Resolves: RHEL-132748 - Allow rhc_playbook_verifier_t stream connect to itself Resolves: RHEL-132748 - Update policy for rhc-worker-playbook Resolves: RHEL-132748 - Allow traceroute_t bind rawip sockets to unreserved ports Resolves: RHEL-130267 - Revert "Allow traceroute_t bind rawip sockets to unreserved ports" Related: RHEL-130267 - Allow sudodomain connect to gkeyringd over a unix stream socket Resolves: RHEL-121158 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-95985 - Allow ssh_agent_type manage generic cache home files Resolves: RHEL-121165 - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t Resolves: RHEL-121165 - Allow boothd connect to systemd-machined over a unix socket Resolves: RHEL-140882 - Macros: Require only "stable" version of selinux-policy (RHEL-141433) - Add insights_client service interfaces Related: RHEL-140893 - Confine rhc-worker-playbook.worker and rhc-playbook-verifier Resolves: RHEL-132748 - Allow gpg manage rpm cache Related: RHEL-108775 - Allow gpg read rpm cache Related: RHEL-108775 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121480 - Allow rules for confined users logged in plasma Resolves: RHEL-133898 - Allow login_userdomain watch lnk_files in /usr Resolves: RHEL-133898 - Revert "Allow NM nvme dispatcher script start systemd services" Resolves: RHEL-111946 - Allow ssh_agent_type create a sockfile in /run/user/USERID Resolves: RHEL-121936 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-111946 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121480 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129879 - Add the rpm_signal() interface Related: RHEL-108826 - Allow tuned_t use its private tmpfs files Related: RHEL-108826 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-66119 - Allow sysadm access to TPM Resolves: RHEL-119055 - Update policy for dhcpc_hook_t Resolves: RHEL-113941 - Allow stap server read virtual memory sysctls Resolves: RHEL-114157 - Allow login_userdomain watch /home and /var directories Resolves: RHEL-119686 - Allow login_userdomain read lastlog Resolves: RHEL-119686 - Allow staff role read/write cockpit-session unix stream sockets Resolves: RHEL-108068 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113941 - Rebuild with the target::exception flag Resolves: RHEL-148247 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148247 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146688 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128542 - Add the fs_write_tmpfs_files() interface Resolves: RHEL-142141 - Dontaudit aide the execmem permission Resolves: RHEL-121480 - Update gpg policy for interactions with rhc-playbook-verifier Resolves: RHEL-132748 - Allow rhc_playbook_verifier_t stream connect to itself Resolves: RHEL-132748 - Update policy for rhc-worker-playbook Resolves: RHEL-132748 - Allow traceroute_t bind rawip sockets to unreserved ports Resolves: RHEL-130267 - Revert "Allow traceroute_t bind rawip sockets to unreserved ports" Related: RHEL-130267 - Allow sudodomain connect to gkeyringd over a unix stream socket Resolves: RHEL-121158 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-95985 - Allow ssh_agent_type manage generic cache home files Resolves: RHEL-121165 - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t Resolves: RHEL-121165 - Allow boothd connect to systemd-machined over a unix socket Resolves: RHEL-140882 - Macros: Require only "stable" version of selinux-policy (RHEL-141433) - Add insights_client service interfaces Related: RHEL-140893 - Confine rhc-worker-playbook.worker and rhc-playbook-verifier Resolves: RHEL-132748 - Allow gpg manage rpm cache Related: RHEL-108775 - Allow gpg read rpm cache Related: RHEL-108775 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121480 - Allow rules for confined users logged in plasma Resolves: RHEL-133898 - Allow login_userdomain watch lnk_files in /usr Resolves: RHEL-133898 - Revert "Allow NM nvme dispatcher script start systemd services" Resolves: RHEL-111946 - Allow ssh_agent_type create a sockfile in /run/user/USERID Resolves: RHEL-121936 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-111946 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121480 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129879 - Add the rpm_signal() interface Related: RHEL-108826 - Allow tuned_t use its private tmpfs files Related: RHEL-108826 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-66119 - Allow sysadm access to TPM Resolves: RHEL-119055 - Update policy for dhcpc_hook_t Resolves: RHEL-113941 - Allow stap server read virtual memory sysctls Resolves: RHEL-114157 - Allow login_userdomain watch /home and /var directories Resolves: RHEL-119686 - Allow login_userdomain read lastlog Resolves: RHEL-119686 - Allow staff role read/write cockpit-session unix stream sockets Resolves: RHEL-108068 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113941 - Allow insights-client manage /etc symlinks Resolves: RHEL-108826 - Allow insights-client get attributes of the rpm executable Resolves: RHEL-127329 - Allow ras-mc-ctl get attributes of the kmod executable Resolves: RHEL-103975 - Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern Resolves: RHEL-101155 - Allow bootupd delete symlinks in the /boot directory Resolves: RHEL-101155 - Update policy for bootupd Resolves: RHEL-101155 - Allow create kerberos files in postgresql db home Resolves: RHEL-123225 - SETools 4.4.4 release - SETools 4.4.3 release - Improve man pages - seinfoflow: Add -r option to get flows into the source type. - seinfoflow.1: Remove references to sepolgen permission map. - AVRule/AVRuleXperm: Treat rules with no permissions as invalid policy. - SELinuxPolicy: Add explicit cast for libspol message - Disable sediff --neverallow and --neverallowxperm options - SETools 4.4.2 release - SETools 4.4.1 release - Update required userspace versions to 3.4 - Drop unnecessary Recommends - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - csh.login: Add csh.local into foreach loop (RHEL-17226) - make setup protected package (#2155529) - Set default umask for non-login shell only if it is set to 0 (#2062601) - Move /var/log/lastlog ownership to systemd (#2066753) - tcsh sets variable p to /usr/sbin from /etc/csh.login (#2066767) - bashrc: Don't set up VTE-specific PROMPT_COMMAND (#2026892) - Skip symlink generation for multipath (RHEL-29139) - sg_inq output conformance for SCSI name string and ATA fields (RHEL-188130) - Skip symlink generation for multipath (RHEL-29139) - Skip symlink generation for multipath (RHEL-29139) - sg_inq output conformance for SCSI name string and ATA fields (RHEL-188130) - Skip symlink generation for multipath (RHEL-29139) - groupmod.c: --help wfix. Resolves: RHEL-130879 - nss.c: shadow_logfd to stderr. Resolves: RHEL-83431 - vipw: restore the original terminal pgrp after editing. Resolves: RHEL-70844 and RHEL-72940 - salt: remove rounds from salt string. Resolves: RHEL-58978 - Disable sssd integration by default. Resolves: RHEL-56352 - login.defs: Update SHA_CRYPT_MAX_ROUNDS from 5000 to 100000. Resolves: RHEL-40195 - groupmod.c: --help wfix. Resolves: RHEL-130879 - nss.c: shadow_logfd to stderr. Resolves: RHEL-83431 - vipw: restore the original terminal pgrp after editing. Resolves: RHEL-70844 and RHEL-72940 - salt: remove rounds from salt string. Resolves: RHEL-58978 - Disable sssd integration by default. Resolves: RHEL-56352 - login.defs: Update SHA_CRYPT_MAX_ROUNDS from 5000 to 100000. Resolves: RHEL-40195 - Fix build with a newer Meson (that we might rebase to) - Resolves: rhbz#2140541 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 2.1 - Fixes: rhbz#1911850 - Own the generated files (as %ghosts) - Fixes: rhbz#1486468 - shimx64.efi is now signed by both 2011 and 2023 MS keys - Update to 16.1 - Add SB for aarch64 - Use AlmaLinux cert - Bump the release to *-4* to work around a build system issue. Related: RHEL-11259 - rebuild for CVE-2026-56853 CVE-2026-56858 CVE-2026-33818 CVE-2026-56860 CVE-2026-56862 - Resolves: RHEL-242042 - Resolves: RHEL-241280 - Resolves: RHEL-241460 - Resolves: RHEL-241825 - Resolves: RHEL-242268 - Rebuild for golang >= 1.26.4 to fix CVE-2026-27145 - Resolves: RHEL-189898 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167688 - Rebuild for CVE-2026-25679 - Re-add test file installation to fix tier0 tests - Resolves: RHEL-158789 - update to https://github.com/containers/skopeo/releases/tag/v1.22.2 - fixes signature verification of images which only sign the per-platform manifest in skopeo proxy - Resolves: RHEL-168166 - Rebuild for new golang to address CVE-2025-68121 - Resolves: RHEL-149649 - update to https://github.com/containers/skopeo/releases/tag/v1.22.0 - Related: RHEL-111919 - update to https://github.com/containers/skopeo/releases/tag/v1.21.0 - Related: RHEL-111919 - rebuild for CVE-2025-58183 - Resolves: RHEL-125721 - update to https://github.com/containers/skopeo/releases/tag/v1.20.0 - Related: RHEL-80816 - Rebuild for CVE-2026-78667 and CVE-2026-111943 - Resolves: RHEL-279016 - Resolves: RHEL-287514 - rebuild for CVE-2026-56853 CVE-2026-56858 CVE-2026-33818 CVE-2026-56860 CVE-2026-56862 - Resolves: RHEL-242042 - Resolves: RHEL-241280 - Resolves: RHEL-241460 - Resolves: RHEL-241825 - Resolves: RHEL-242268 - Rebuild for golang >= 1.26.4 to fix CVE-2026-27145 - Resolves: RHEL-189898 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167688 - Rebuild for CVE-2026-25679 - Re-add test file installation to fix tier0 tests - Resolves: RHEL-158789 - update to https://github.com/containers/skopeo/releases/tag/v1.22.2 - fixes signature verification of images which only sign the per-platform manifest in skopeo proxy - Resolves: RHEL-168166 - Rebuild for new golang to address CVE-2025-68121 - Resolves: RHEL-149649 - update to https://github.com/containers/skopeo/releases/tag/v1.22.0 - Related: RHEL-111919 - update to https://github.com/containers/skopeo/releases/tag/v1.21.0 - Related: RHEL-111919 - rebuild for CVE-2025-58183 - Resolves: RHEL-125721 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - use tmpfiles.d to create /var/lib/smartmontools (RHEL-132500) - smartd would not start with huge FD limits (#RHEL-15505) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop BuildRequires dependency on gtest - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use __cmake_in_source_build - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Updated to new release. - Dropped version-related patch which has been applied upstream (BZ #1527850). - Update to 4.10.2-2 Resolves: RHEL-152471 - Update to 4.10.2-1 Resolves: RHEL-142635 - Update to 4.10.1-2 Resolves: RHEL-121474 - Update to 4.10.1-1 Resolves: RHEL-121474 - Update to 4.10.0-4 Resolves: RHEL-113795 - Update to 4.10.0-3 Resolves: RHEL-113795 - Update to 4.10.0-2 Resolves: RHEL-113795 - Update to 4.10.0 Resolves: RHEL-110500 Resolves: RHEL-110501 Resolves: RHEL-110502 Resolves: RHEL-110503 - Update to 4.9.2 Resolves: RHEL-101717 Resolves: RHEL-101718 Resolves: RHEL-101719 Resolves: RHEL-101720 - Update to 4.9.1-2 in RHEL 9 Resolves: RHEL-86668 Resolves: RHEL-86644 Resolves: RHEL-86647 Resolves: RHEL-86646 - Update to 4.11.0-1 Resolves: RHEL-157817 - Update to 4.10.2-2 Resolves: RHEL-152471 - Update to 4.10.2-1 Resolves: RHEL-142635 - Update to 4.10.1-2 Resolves: RHEL-121474 - Update to 4.10.1-1 Resolves: RHEL-121474 - Update to 4.10.0-4 Resolves: RHEL-113795 - Update to 4.10.0-3 Resolves: RHEL-113795 - Update to 4.10.0-2 Resolves: RHEL-113795 - Update to 4.10.0 Resolves: RHEL-110500 Resolves: RHEL-110501 Resolves: RHEL-110502 Resolves: RHEL-110503 - Update to 4.9.2 Resolves: RHEL-101717 Resolves: RHEL-101718 Resolves: RHEL-101719 Resolves: RHEL-101720 - Update to 4.11.2-4 - Update to 4.11.2-3 - Update to 4.11.2-2 - Update to 4.11.2-1 - Update to 4.11.0-1 Resolves: RHEL-157818 - Update to 4.10.2-2 Resolves: RHEL-152471 - Update to 4.10.2-1 Resolves: RHEL-142635 - Update to 4.10.1-2 Resolves: RHEL-121474 - Update to 4.10.1-1 Resolves: RHEL-121474 - Update to 4.10.0-4 Resolves: RHEL-113795 - Update to 4.10.2-2 Resolves: RHEL-152471 - Update to 4.10.2-1 Resolves: RHEL-142635 - Update to 4.10.1-2 Resolves: RHEL-121474 - Update to 4.10.1-1 Resolves: RHEL-121474 - Update to 4.10.0-4 Resolves: RHEL-113795 - Update to 4.10.0-3 Resolves: RHEL-113795 - Update to 4.10.0-2 Resolves: RHEL-113795 - Update to 4.10.0 Resolves: RHEL-110500 Resolves: RHEL-110501 Resolves: RHEL-110502 Resolves: RHEL-110503 - Update to 4.9.2 Resolves: RHEL-101717 Resolves: RHEL-101718 Resolves: RHEL-101719 Resolves: RHEL-101720 - Update to 4.9.1-2 in RHEL 9 Resolves: RHEL-86668 Resolves: RHEL-86644 Resolves: RHEL-86647 Resolves: RHEL-86646 - Update to 4.11.0-1 Resolves: RHEL-157817 - Update to 4.10.2-2 Resolves: RHEL-152471 - Update to 4.10.2-1 Resolves: RHEL-142635 - Update to 4.10.1-2 Resolves: RHEL-121474 - Update to 4.10.1-1 Resolves: RHEL-121474 - Update to 4.10.0-4 Resolves: RHEL-113795 - Update to 4.10.0-3 Resolves: RHEL-113795 - Update to 4.10.0-2 Resolves: RHEL-113795 - Update to 4.10.0 Resolves: RHEL-110500 Resolves: RHEL-110501 Resolves: RHEL-110502 Resolves: RHEL-110503 - Update to 4.9.2 Resolves: RHEL-101717 Resolves: RHEL-101718 Resolves: RHEL-101719 Resolves: RHEL-101720 - Update to 4.11.2-4 - Update to 4.11.2-3 - Update to 4.11.2-2 - Update to 4.11.2-1 - Update to 4.11.0-1 Resolves: RHEL-157818 - Update to 4.10.2-2 Resolves: RHEL-152471 - Update to 4.10.2-1 Resolves: RHEL-142635 - Update to 4.10.1-2 Resolves: RHEL-121474 - Update to 4.10.1-1 Resolves: RHEL-121474 - Update to 4.10.0-4 Resolves: RHEL-113795 - Enable sqlite3_deserialize and sqlite3_serialize interfaces - Resolves: RHEL-155950 - Fixes CVE-2025-6965 - Enabled sqlite-session feature - Resolves: RHEL-89962 - Fixes CVE-2026-11822 - Resolves: RHEL-218273 - Fixes CVE-2026-11824 - Resolves: RHEL-218281 - Enable sqlite3_deserialize and sqlite3_serialize interfaces - Resolves: RHEL-155950 - Fixes CVE-2025-6965 - Enabled sqlite-session feature - Resolves: RHEL-89962 - CVE-2021-41072 squashfs-tools: additional write outside destination directory exploit fix rhbz#2007304 - CVE-2021-40153 squashfs-tools: unvalidated filepaths allow writing outside of destination rhbz#2000638 - limit CPUs on large machines to avoid running out of resources rhbz#2023218 - Rebuilt for gating testing - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Rebase to upstream release v61.0 - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - bump release to rebuild in sidetag - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - bump release to rebuild in sidetag - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Rebase to upstream release v60.0 - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331 - Fix pyverbs tests - Resolves: RHEL-107929, RHEL-107930 - Rebase to upstream release v57.0 - Resolves: RHEL-76570, RHEL-45644, RHEL-72077, RHEL-68506, RHEL-94449 - Fix data corruption in bnxt_re - Resolves: RHEL-89179 - Rebase to upstream release v54.0 - Resolves: RHEL-52886, RHEL-54647, RHEL-51876 - Rebase to upstream release v51.0 - Resolves: RHEL-24473, RHEL-23180 - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Rebase to v6.12; drop upstream patches on top of 6.7, drop the harcoded "-isystem /usr/include" from CPPFLAGS (RHEL-8646). - Fix incorrect syscall name reporting in restart_syscall() on attach when PTRACE_GET_SYSCALL_INFO is in use (RHEL-65109). - Update net-yy-inet* and linkat--secontext_mismatch tests. - Rebase to v6.7; drop upstream patches on top of 5.18 (RHEL-8646). - Updated the SPDX license expression. - Speed up loading client CA list from CAfile Resolves: RHEL-52321 - Do not load all CAs in client mode to allow continued use of BEGIN TRUSTED CERTIFICATE format Resolves: RHEL-52317 - New upstream release 5.71 Resolves: RHEL-2468 - Enable socket activation support - verify upstream source in %prep - clean up stale conditionals - Fix use of encrypted key files and password retry with OpenSSL 3 Resolves: rhbz#2151888 - Debrand for AlmaLinux - fix: Print list of environments without --set/--list (jhnidek@redhat.com) - RHEL-126157: Update GCP to Google Cloud in log messages (crag@redhat.com) - fix: Update user-facing GCP refrences to Google Cloud (crag@redhat.com) - feat: check if --set arg is empty when the environments module is called (manuelcanorojo@gmail.com) - feat: Added more debug prints to cloud-what (jhnidek@redhat.com) - fix(test): Fix unit test of aws (jhnidek@redhat.com) - fix: Fix getting AWS IMDSv2 signature (jhnidek@redhat.com) - chore: Make new black happy again (jhnidek@redhat.com) - chore: Increased log level of messages (jhnidek@redhat.com) - fix: Use IMDSv2 for signature first (jhnidek@redhat.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Georgian) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Added translation using Weblate (Finnish) (noreply-addon- languages@weblate.org) - fix: TypeError in _get_tls_handshake_info type hinting (macano@redhat.com) - feat: added signature type log in TLS handshake (macano@redhat.com) - feat: added internal method to get tls handshake info (manuelcanorojo@gmail.com) - ci: bump actions/upload-artifact from 5 to 6 (49699333+dependabot[bot]@users.noreply.github.com) - Fix profile upload because of missing self.cp (suttner@atix.de) - Fix upload profile if rhsmcertd is not running at all (suttner@atix.de) - ci: bump actions/checkout from 5 to 6 (49699333+dependabot[bot]@users.noreply.github.com) - Translated using Weblate (Korean) (simmon@nplob.com) - ci: bump actions/upload-artifact from 4 to 5 (49699333+dependabot[bot]@users.noreply.github.com) - feat: [1.29] Added dnf4 warning about skewed clock (jhnidek@redhat.com) - fix: [1.29] Require findutils in .spec file (jhnidek@redhat.com) - ci: bump actions/checkout from 4 to 5 (49699333+dependabot[bot]@users.noreply.github.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Spanish) (fserrador@gmail.com) - Translated using Weblate (Spanish) (jsefler@redhat.com) - Translated using Weblate (Korean) (simmon@nplob.com) - fix: [1.29] Wait random time before reaching IMDS server (jhnidek@redhat.com) - feat: [1.29] Call random.seed() at begining of auto-register (jhnidek@redhat.com) - feat: [1.29] Better control over auto-reg waiting game (jhnidek@redhat.com) - fix: [1.29] Enable content during auto-registration v2 (jhnidek@redhat.com) - Translated using Weblate (Italian) (info@salvatorecocuzza.it) - Translated using Weblate (Italian) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (Italian) (info@salvatorecocuzza.it) - Translated using Weblate (Spanish) (fserrador@gmail.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Chinese (Traditional) (zh_TW)) (chzang55@gmail.com) - Translated using Weblate (Chinese (Simplified) (zh_CN)) (mhorky@redhat.com) - Translated using Weblate (Georgian) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (French) (leane.grasser@proton.me) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (Korean) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (Korean) (noreply-mt-weblate-translation- memory@weblate.org) - Update translation files (noreply@weblate.org) - fix: Handle improperly closed connections (mhorky@redhat.com) - ci: use the right distro for coverage reporting (ptoscano@redhat.com) - New extraction for translatable strings (ptoscano@redhat.com) - Translated using Weblate (Italian) (toscano.pino@tiscali.it) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (French) (leane.grasser@proton.me) - tests: fix mocking of get_terminal_width() in TestColumnize (ptoscano@redhat.com) - feat: print compliance errors & syspurpose status only in entitlement mode (ptoscano@redhat.com) - feat: print "registered" as status when using SCA (ptoscano@redhat.com) - feat: print "not registered" on status when not registered (ptoscano@redhat.com) - tests: force syspurpose tests in test_status to non-SCA (ptoscano@redhat.com) - refactor: move determination of content access mode in own method (ptoscano@redhat.com) - tests: move StubIdentity to stubs (ptoscano@redhat.com) - tests: cleanup dead/broken bits in test_status (ptoscano@redhat.com) - chore: move banner printing to its own function (ptoscano@redhat.com) - fix: Append two additional facts to the graylist (pkoprda@redhat.com) - refactor: Use class constant instead of variable graylist (pkoprda@redhat.com) - fix: Do not upload profile from DNF, when it is disabled in conf (jhnidek@redhat.com) - feat: dnf plugin - outsource uploading of profile to rhsmcertd. (jhnidek@redhat.com) - feat: Enable register with environment names and environment types (jhnidek@redhat.com) - feat: support registering specifying environments with activation keys (ryanverdile@gmail.com) - chore: Remove auto-assign CI job (mhorky@redhat.com) - feat: [1.29] Added basic configuration for Packit (jhnidek@redhat.com) - Revert "feat: Disable anonymous cloud registration temporarily" (ptoscano@redhat.com) - Revert "feat: forcefully switch automatic cloud registration to v1" (ptoscano@redhat.com) - Translated using Weblate (Chinese (Simplified) (zh_CN)) (ptoscano@redhat.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (French) (leane.grasser@proton.me) - Update translation files (noreply@weblate.org) - New extraction for translatable strings (ptoscano@redhat.com) - Translated using Weblate (Italian) (info@salvatorecocuzza.it) - Translated using Weblate (French) (leane.grasser@proton.me) - Translated using Weblate (German) (atalanttore@googlemail.com) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - [1.29] feat/cct-868: Subset of list command options marked as deprecated * Options --available, --all, --ondate, --servicelevel --no-overlap --match- install, --pool-only, --afterdate were marked as deprecated in ListCommand definition of their help string. (mgrunwal@redhat.com) - fix: Handle Retry-After headers better for 429 responses (mhorky@redhat.com) - feat: Better automatic registration logging (mhorky@redhat.com) - fix: perform autoreg waiting when performing standard autoreg (ptoscano@redhat.com) - chore: move autoreg waiting code in own function (ptoscano@redhat.com) - docs: update proxy details in man page (jvlcek@redhat.com) - feat: forcefully switch automatic cloud registration to v1 (ptoscano@redhat.com) - Debrand for AlmaLinux - fix: Print list of environments without --set/--list (jhnidek@redhat.com) - RHEL-126157: Update GCP to Google Cloud in log messages (crag@redhat.com) - fix: Update user-facing GCP refrences to Google Cloud (crag@redhat.com) - feat: check if --set arg is empty when the environments module is called (manuelcanorojo@gmail.com) - feat: Added more debug prints to cloud-what (jhnidek@redhat.com) - fix(test): Fix unit test of aws (jhnidek@redhat.com) - fix: Fix getting AWS IMDSv2 signature (jhnidek@redhat.com) - chore: Make new black happy again (jhnidek@redhat.com) - chore: Increased log level of messages (jhnidek@redhat.com) - fix: Use IMDSv2 for signature first (jhnidek@redhat.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Georgian) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Added translation using Weblate (Finnish) (noreply-addon- languages@weblate.org) - fix: TypeError in _get_tls_handshake_info type hinting (macano@redhat.com) - feat: added signature type log in TLS handshake (macano@redhat.com) - feat: added internal method to get tls handshake info (manuelcanorojo@gmail.com) - ci: bump actions/upload-artifact from 5 to 6 (49699333+dependabot[bot]@users.noreply.github.com) - Fix profile upload because of missing self.cp (suttner@atix.de) - Fix upload profile if rhsmcertd is not running at all (suttner@atix.de) - ci: bump actions/checkout from 5 to 6 (49699333+dependabot[bot]@users.noreply.github.com) - Translated using Weblate (Korean) (simmon@nplob.com) - ci: bump actions/upload-artifact from 4 to 5 (49699333+dependabot[bot]@users.noreply.github.com) - feat: [1.29] Added dnf4 warning about skewed clock (jhnidek@redhat.com) - fix: [1.29] Require findutils in .spec file (jhnidek@redhat.com) - ci: bump actions/checkout from 4 to 5 (49699333+dependabot[bot]@users.noreply.github.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Spanish) (fserrador@gmail.com) - Translated using Weblate (Spanish) (jsefler@redhat.com) - Translated using Weblate (Korean) (simmon@nplob.com) - fix: [1.29] Wait random time before reaching IMDS server (jhnidek@redhat.com) - feat: [1.29] Call random.seed() at begining of auto-register (jhnidek@redhat.com) - feat: [1.29] Better control over auto-reg waiting game (jhnidek@redhat.com) - fix: [1.29] Enable content during auto-registration v2 (jhnidek@redhat.com) - Translated using Weblate (Italian) (info@salvatorecocuzza.it) - Translated using Weblate (Italian) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (Italian) (info@salvatorecocuzza.it) - Translated using Weblate (Spanish) (fserrador@gmail.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Chinese (Traditional) (zh_TW)) (chzang55@gmail.com) - Translated using Weblate (Chinese (Simplified) (zh_CN)) (mhorky@redhat.com) - Translated using Weblate (Georgian) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (French) (leane.grasser@proton.me) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (Korean) (noreply-mt-weblate-translation- memory@weblate.org) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (Korean) (noreply-mt-weblate-translation- memory@weblate.org) - Update translation files (noreply@weblate.org) - fix: Handle improperly closed connections (mhorky@redhat.com) - ci: use the right distro for coverage reporting (ptoscano@redhat.com) - New extraction for translatable strings (ptoscano@redhat.com) - Translated using Weblate (Italian) (toscano.pino@tiscali.it) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (French) (leane.grasser@proton.me) - tests: fix mocking of get_terminal_width() in TestColumnize (ptoscano@redhat.com) - feat: print compliance errors & syspurpose status only in entitlement mode (ptoscano@redhat.com) - feat: print "registered" as status when using SCA (ptoscano@redhat.com) - feat: print "not registered" on status when not registered (ptoscano@redhat.com) - tests: force syspurpose tests in test_status to non-SCA (ptoscano@redhat.com) - refactor: move determination of content access mode in own method (ptoscano@redhat.com) - tests: move StubIdentity to stubs (ptoscano@redhat.com) - tests: cleanup dead/broken bits in test_status (ptoscano@redhat.com) - chore: move banner printing to its own function (ptoscano@redhat.com) - fix: Append two additional facts to the graylist (pkoprda@redhat.com) - refactor: Use class constant instead of variable graylist (pkoprda@redhat.com) - fix: Do not upload profile from DNF, when it is disabled in conf (jhnidek@redhat.com) - feat: dnf plugin - outsource uploading of profile to rhsmcertd. (jhnidek@redhat.com) - feat: Enable register with environment names and environment types (jhnidek@redhat.com) - feat: support registering specifying environments with activation keys (ryanverdile@gmail.com) - chore: Remove auto-assign CI job (mhorky@redhat.com) - feat: [1.29] Added basic configuration for Packit (jhnidek@redhat.com) - Revert "feat: Disable anonymous cloud registration temporarily" (ptoscano@redhat.com) - Revert "feat: forcefully switch automatic cloud registration to v1" (ptoscano@redhat.com) - Translated using Weblate (Chinese (Simplified) (zh_CN)) (ptoscano@redhat.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (French) (leane.grasser@proton.me) - Update translation files (noreply@weblate.org) - New extraction for translatable strings (ptoscano@redhat.com) - Translated using Weblate (Italian) (info@salvatorecocuzza.it) - Translated using Weblate (French) (leane.grasser@proton.me) - Translated using Weblate (German) (atalanttore@googlemail.com) - Translated using Weblate (Korean) (simmon@nplob.com) - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com) - [1.29] feat/cct-868: Subset of list command options marked as deprecated * Options --available, --all, --ondate, --servicelevel --no-overlap --match- install, --pool-only, --afterdate were marked as deprecated in ListCommand definition of their help string. (mgrunwal@redhat.com) - fix: Handle Retry-After headers better for 429 responses (mhorky@redhat.com) - feat: Better automatic registration logging (mhorky@redhat.com) - fix: perform autoreg waiting when performing standard autoreg (ptoscano@redhat.com) - chore: move autoreg waiting code in own function (ptoscano@redhat.com) - docs: update proxy details in man page (jvlcek@redhat.com) - feat: forcefully switch automatic cloud registration to v1 (ptoscano@redhat.com) - Fix issue with missing {?dist} in Release. (jhnidek@redhat.com) - Use the same version and release as Fedora already use - New package built with tito - Using new version pattern for subscription-manager-rhsm-certificates - CVE-2026-82474 sudo: execveat(2) intercept/log_subcmds bypass Resolves: RHEL-255647 - CVE-2026-35535 sudo: Privilege escalation due to failure in privilege drop calls Resolves: RHEL-166069 - Request to backport support for regex in sudo [rhel-9] Resolves: RHEL-1376 - Rebase of sudo to 1.9.17p2 [rhel-9] Resolves: RHEL-128623 - sudo passes SHELL environment variable twice to the shell being executed [rhel-9] Resolves: RHEL-127359 RHEL: 9.7.0 ERRATUM - sudo missing spacing and separator in log when using "--preserve-env=list" Resolves: RHEL-71916 - CVE-2025-32462 sudo: LPE via host option Resolves: RHEL-100020 - CVE-2026-96512 sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization [rhel-9.8.z] Resolves: RHEL-267328 - CVE-2026-82474 sudo: execveat(2) intercept/log_subcmds bypass Resolves: RHEL-255647 - CVE-2026-35535 sudo: Privilege escalation due to failure in privilege drop calls Resolves: RHEL-166069 - Request to backport support for regex in sudo [rhel-9] Resolves: RHEL-1376 - Rebase of sudo to 1.9.17p2 [rhel-9] Resolves: RHEL-128623 - sudo passes SHELL environment variable twice to the shell being executed [rhel-9] Resolves: RHEL-127359 RHEL: 9.7.0 ERRATUM - sudo missing spacing and separator in log when using "--preserve-env=list" Resolves: RHEL-71916 - CVE-2025-32462 sudo: LPE via host option Resolves: RHEL-100020 - CVE-2026-35535 sudo: Privilege escalation due to failure in privilege drop calls Resolves: RHEL-166069 - Request to backport support for regex in sudo [rhel-9] Resolves: RHEL-1376 - Rebase of sudo to 1.9.17p2 [rhel-9] Resolves: RHEL-128623 - sudo passes SHELL environment variable twice to the shell being executed [rhel-9] Resolves: RHEL-127359 RHEL: 9.7.0 ERRATUM - sudo missing spacing and separator in log when using "--preserve-env=list" Resolves: RHEL-71916 - CVE-2025-32462 sudo: LPE via host option Resolves: RHEL-100020 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - 1.7, fixes #1786376. - Debrand for AlmaLinux - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558) - timer: rebase last_trigger timestamp if needed (RHEL-118215) - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215) - strv: introduce string_strv_hashmap_remove() (RHEL-14112) - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112) - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112) - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801) - Debrand for AlmaLinux - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - Debrand for AlmaLinux - test: rename the start limit subtest (RHEL-212086) - ci: install GPG keys for Fedora 42 (RHEL-212086) - core: increment start limit counter only when we can start the unit (RHEL-212086) - TEST-07-PID1: wait for systemd-resolved being stopped (RHEL-212086) - test: extend start limit interval (RHEL-212086) - ci: bump the mkosi job to Ubuntu Noble (RHEL-212086) - ci: bump super-linter to v8.7.0 (RHEL-212086) - ci: explicitly disable multi status for Super-Linter (RHEL-212086) - github/linter: disable ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT for super-linter (RHEL-212086) - test: install iscsi-gen-initiatorname from iscsi-initiator-utils (RHEL-212086) - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - Debrand for AlmaLinux - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558) - timer: rebase last_trigger timestamp if needed (RHEL-118215) - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215) - strv: introduce string_strv_hashmap_remove() (RHEL-14112) - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112) - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112) - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801) - Debrand for AlmaLinux - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - Debrand for AlmaLinux - test: rename the start limit subtest (RHEL-212086) - ci: install GPG keys for Fedora 42 (RHEL-212086) - core: increment start limit counter only when we can start the unit (RHEL-212086) - TEST-07-PID1: wait for systemd-resolved being stopped (RHEL-212086) - test: extend start limit interval (RHEL-212086) - ci: bump the mkosi job to Ubuntu Noble (RHEL-212086) - ci: bump super-linter to v8.7.0 (RHEL-212086) - ci: explicitly disable multi status for Super-Linter (RHEL-212086) - github/linter: disable ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT for super-linter (RHEL-212086) - test: install iscsi-gen-initiatorname from iscsi-initiator-utils (RHEL-212086) - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - Debrand for AlmaLinux - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558) - timer: rebase last_trigger timestamp if needed (RHEL-118215) - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215) - strv: introduce string_strv_hashmap_remove() (RHEL-14112) - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112) - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112) - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801) - Debrand for AlmaLinux - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - Debrand for AlmaLinux - test: rename the start limit subtest (RHEL-212086) - ci: install GPG keys for Fedora 42 (RHEL-212086) - core: increment start limit counter only when we can start the unit (RHEL-212086) - TEST-07-PID1: wait for systemd-resolved being stopped (RHEL-212086) - test: extend start limit interval (RHEL-212086) - ci: bump the mkosi job to Ubuntu Noble (RHEL-212086) - ci: bump super-linter to v8.7.0 (RHEL-212086) - ci: explicitly disable multi status for Super-Linter (RHEL-212086) - github/linter: disable ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT for super-linter (RHEL-212086) - test: install iscsi-gen-initiatorname from iscsi-initiator-utils (RHEL-212086) - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - Debrand for AlmaLinux - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558) - timer: rebase last_trigger timestamp if needed (RHEL-118215) - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215) - strv: introduce string_strv_hashmap_remove() (RHEL-14112) - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112) - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112) - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801) - Debrand for AlmaLinux - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - Debrand for AlmaLinux - test: rename the start limit subtest (RHEL-212086) - ci: install GPG keys for Fedora 42 (RHEL-212086) - core: increment start limit counter only when we can start the unit (RHEL-212086) - TEST-07-PID1: wait for systemd-resolved being stopped (RHEL-212086) - test: extend start limit interval (RHEL-212086) - ci: bump the mkosi job to Ubuntu Noble (RHEL-212086) - ci: bump super-linter to v8.7.0 (RHEL-212086) - ci: explicitly disable multi status for Super-Linter (RHEL-212086) - github/linter: disable ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT for super-linter (RHEL-212086) - test: install iscsi-gen-initiatorname from iscsi-initiator-utils (RHEL-212086) - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - Debrand for AlmaLinux - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558) - timer: rebase last_trigger timestamp if needed (RHEL-118215) - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215) - strv: introduce string_strv_hashmap_remove() (RHEL-14112) - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112) - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112) - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801) - Debrand for AlmaLinux - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - Debrand for AlmaLinux - test: rename the start limit subtest (RHEL-212086) - ci: install GPG keys for Fedora 42 (RHEL-212086) - core: increment start limit counter only when we can start the unit (RHEL-212086) - TEST-07-PID1: wait for systemd-resolved being stopped (RHEL-212086) - test: extend start limit interval (RHEL-212086) - ci: bump the mkosi job to Ubuntu Noble (RHEL-212086) - ci: bump super-linter to v8.7.0 (RHEL-212086) - ci: explicitly disable multi status for Super-Linter (RHEL-212086) - github/linter: disable ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT for super-linter (RHEL-212086) - test: install iscsi-gen-initiatorname from iscsi-initiator-utils (RHEL-212086) - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - Debrand for AlmaLinux - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558) - timer: rebase last_trigger timestamp if needed (RHEL-118215) - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215) - strv: introduce string_strv_hashmap_remove() (RHEL-14112) - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112) - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112) - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801) - Debrand for AlmaLinux - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - Debrand for AlmaLinux - test: rename the start limit subtest (RHEL-212086) - ci: install GPG keys for Fedora 42 (RHEL-212086) - core: increment start limit counter only when we can start the unit (RHEL-212086) - TEST-07-PID1: wait for systemd-resolved being stopped (RHEL-212086) - test: extend start limit interval (RHEL-212086) - ci: bump the mkosi job to Ubuntu Noble (RHEL-212086) - ci: bump super-linter to v8.7.0 (RHEL-212086) - ci: explicitly disable multi status for Super-Linter (RHEL-212086) - github/linter: disable ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT for super-linter (RHEL-212086) - test: install iscsi-gen-initiatorname from iscsi-initiator-utils (RHEL-212086) - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - Debrand for AlmaLinux - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558) - timer: rebase last_trigger timestamp if needed (RHEL-118215) - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215) - strv: introduce string_strv_hashmap_remove() (RHEL-14112) - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112) - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112) - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801) - Debrand for AlmaLinux - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - Debrand for AlmaLinux - test: rename the start limit subtest (RHEL-212086) - ci: install GPG keys for Fedora 42 (RHEL-212086) - core: increment start limit counter only when we can start the unit (RHEL-212086) - TEST-07-PID1: wait for systemd-resolved being stopped (RHEL-212086) - test: extend start limit interval (RHEL-212086) - ci: bump the mkosi job to Ubuntu Noble (RHEL-212086) - ci: bump super-linter to v8.7.0 (RHEL-212086) - ci: explicitly disable multi status for Super-Linter (RHEL-212086) - github/linter: disable ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT for super-linter (RHEL-212086) - test: install iscsi-gen-initiatorname from iscsi-initiator-utils (RHEL-212086) - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - Debrand for AlmaLinux - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558) - timer: rebase last_trigger timestamp if needed (RHEL-118215) - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215) - strv: introduce string_strv_hashmap_remove() (RHEL-14112) - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112) - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112) - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801) - Debrand for AlmaLinux - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - Debrand for AlmaLinux - test: rename the start limit subtest (RHEL-212086) - ci: install GPG keys for Fedora 42 (RHEL-212086) - core: increment start limit counter only when we can start the unit (RHEL-212086) - TEST-07-PID1: wait for systemd-resolved being stopped (RHEL-212086) - test: extend start limit interval (RHEL-212086) - ci: bump the mkosi job to Ubuntu Noble (RHEL-212086) - ci: bump super-linter to v8.7.0 (RHEL-212086) - ci: explicitly disable multi status for Super-Linter (RHEL-212086) - github/linter: disable ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT for super-linter (RHEL-212086) - test: install iscsi-gen-initiatorname from iscsi-initiator-utils (RHEL-212086) - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - Add upstream patch to improve error message for --one-top-level with absolute path (unsupported as a result of CVE-2025-45582 fix) - Backport fix for regression in the --no-overwrite-dir option Upstream commit 4e742fc8674064a9fa00d4483d06aca48d5b0463, discussed in https://www.mail-archive.com/bug-tar@gnu.org/msg06445.html - Fix the last patch to solve a regression with -x and --xattrs: RHEL-136277 also, fix another tiny mistake in the patch (w/o visible consequences) - Backport upstream changes to jailify extraction directory Includes related gnulib changes to add openat2 Fixes CVE-2025-45582 - Warn “file changed as we read it” less often - Backport upstream patches for CVE-2026-18477, fixes a bug where incremental restore with cyclic renames between backups may create a temporary directory at an archive-controlled path outside the extraction tree. The fix for CVE-2025-45582 already prevents exploiting this problem, so it is more a correctness and hardening change. - Backport upstream fix for CVE-2026-5704 (file injection hidden from -t) - Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix) Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks). - Upstream fix for build with libacl 2.4.0 - Add upstream patch to improve error message for --one-top-level with absolute path (unsupported as a result of CVE-2025-45582 fix) - Backport fix for regression in the --no-overwrite-dir option Upstream commit 4e742fc8674064a9fa00d4483d06aca48d5b0463, discussed in https://www.mail-archive.com/bug-tar@gnu.org/msg06445.html - Fix the last patch to solve a regression with -x and --xattrs: RHEL-136277 also, fix another tiny mistake in the patch (w/o visible consequences) - Backport upstream changes to jailify extraction directory Includes related gnulib changes to add openat2 Fixes CVE-2025-45582 - Rebuilt for i686 release Resolves: rhbz#2099397 - Rebuild to pick up new build flags from redhat-rpm-config (#1984652) - Re-enable LTO - Update to version 1.4.14 - resolves: RHEL-114549 - Update to version 1.4.13 - resolves: RHEL-89880 - Update to version 1.4.12 - resolves: RHEL-59791 - resolves: RHEL-33756 - Rebase to version 1.4.10 - resolves: RHEL-16480 - Rebase to version 1.4.9 - fix the Requires package name for teamd-devel - teamd: stop iterating callbacks when a loop restart is requested (rhbz#2148852) - teamd: do no remove the ports on shutdown with -N (rhbz#2148854) - Rebuilt with a new version to pass the fixed gating test (rhbz#2060445) - utils/team2bond: do not add updelay/downdelay if already exist (rhbz#2060445) - utils/team2bond: do not add miimon if already exist (rhbz#2060445) - Revert "teamd: Disregard current state when considering port enablement" [1894546] - Remove an extra line in spec file - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Build util team2bond in teamd rpm [1986788] - Add some cautions to util team2bond [1986788] - Add team2bond man doc [1986788] - gating: fix the wrong link of openvswitch for RHEL-9 [1970175] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Retrieve a time stamp of the info page from a patch date header - Correct version in an info page - Set time stamp stored in an info page to the latest patch - Update URL and Source addresses (thanks to Robert Scheck) - Verify an upstream archive signature - Fix a regression in closing a file descriptor if no --output was given (bug #1898138) - Do not leak a file descriptor of the --output argument to a command - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Clarify RSS size as kibibytes in a documentation - Backport a number of memory leak fixes Resolves: rhbz#1938885 - Rebuild Resolves: rhbz#2003007 - Rebuild Related: rhbz#1910707 - Ensure gating test files are present in the source repo Related: rhbz#1910707 - Upgrade to tmux-3.2a (CVE-2020-27347) Resolves: rhbz#1910707 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebase to 3.2.3 Resolves: RHEL-23206 - Remove misapplied license Resolves: rhbz#2160307 - Rebase to 3.2.2 - Use systemd-sysusers to create user Resolves: CVE-2023-22745 Resolves: rhbz#2095479 Resolves: rhbz#2160307 Resolves: rhbz#2162613 - Fix memory leaks, potential crashes, upgrade to OpenSSL 3 Resolves: rhbz#2041919 - Fix trace messages (RHEL-86597) - Rebuild without side-tags (RHEL-76155) - Rebase to version 3.3.1 (RHEL-76155) - rebase to 2.1.1 (RHEL-67117) Interpret ipv4-mapped ipv6 addresses (::ffff:A.B.C.D) as true ipv4. There are no ipv4-mapped addresses in the real network which we operate on, so use just ipv4 in such cases, but allow users to specify it this way for convenience. Return back more robast poll(2) loop handling. - make traceroute follow RFC-3484 conditionally (RHEL-58449) - add gating.yaml - fix improper command line parsing (CVE-2023-46316) - reflect review comments from Fedora Review (#2001467) - source package renamed to tree-pkg to make it work with Pagure and Gitlab - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Disable tuna apply Resolves: RHEL-140839 - Update to upstream version 0.20 - Remove all patches (now included in upstream) - Remove oscilloscope (unsupported in RHEL) Resolves: RHEL-83079 - When a realtime scheduling policy is used, default the prio to 1 Resolves: RHEL-106072 - Add -U and -K to the spread command - Add a few clean-ups Resolves: RHEL-108968 - Disable cpu_power from showing in help menu and checking for cpu_power match functionality. Resolves: RHEL-107847 - Fix show_threads -t and show_irqs -q to not match everything if no match - Fix run command failing to apply BATCH policy - Add -U and -K to the move command Resolves: RHEL-86862 RHEL-106065 RHEL-106066 - Applied tuna: Fix help.py syntax warnings and tuna: help.py Resolves: RHEL-106289 - Fix syntax warnings with raw strings Resolves: RHEL-106287 - Add cpu_power command Resolves: RHEL-106293 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-50568 - clear plugin repository when stopping tuning - man: add description of the balanced-battery profile - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181668 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-50568 - clear plugin repository when stopping tuning - man: add description of the balanced-battery profile - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181668 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - Update to tzdata-2026a (RHEL-154025) - Correct the transition times for Moldova. - The POSIXRULES option is now obsolete. - Update to tzdata-2025c (RHEL-135158) - Update leap seconds file expiration date - Included NEWS file with docs. (RHEL-105043) - Update to tzdata-2025b (RHEL-84741) - Chile's Aysén Region moves from -04/-03 to -03 year-round, diverging from America/Santiago and creating a new zone America/Coyhaique. Update to tzdata-2025a (RHEL-74308) - Paraguay is now permanently at -03. This impacts timestamps starting on 2025-03-22. - Includes improvements to pre-1991 data for the Philippines. - Etc/Unknown is now reserved. - Don't use -source 1.6 and -target 1.6 with javac. (RHEL-70308) - Harden against links to removed zones (RHEL-60063) - Update to tzdata-2024b - Improve historical data for Mexico, Mongolia, and Portugal. - System V names are now obsolescent. - The main data form now uses %z. - The code now conforms to RFC 8536 for early timestamps. - Support POSIX.1-2024, which removes asctime_r and ctime_r. - Assume POSIX.2-1992 or later for shell scripts. - SUPPORT_C89 now defaults to 1. - Include two upstream patches for month names as in April vs Apr. - Add java patch to fix incorrect calculations for Africa/Casablanca starting in 2027. (RHEL-26860) - Update to tzdata-2026b (RHEL-170784) - British Columbia’s 2026-03-08 spring forward is expected to be its last transition as it moves to permanent -07. - Update to tzdata-2026a (RHEL-154025) - Correct the transition times for Moldova. - The POSIXRULES option is now obsolete. - Update to tzdata-2025c (RHEL-135158) - Update leap seconds file expiration date - Included NEWS file with docs. (RHEL-105043) - Update to tzdata-2025b (RHEL-84741) - Chile's Aysén Region moves from -04/-03 to -03 year-round, diverging from America/Santiago and creating a new zone America/Coyhaique. Update to tzdata-2025a (RHEL-74308) - Paraguay is now permanently at -03. This impacts timestamps starting on 2025-03-22. - Includes improvements to pre-1991 data for the Philippines. - Etc/Unknown is now reserved. - Don't use -source 1.6 and -target 1.6 with javac. (RHEL-70308) - Harden against links to removed zones (RHEL-60063) - Update to tzdata-2024b - Improve historical data for Mexico, Mongolia, and Portugal. - System V names are now obsolescent. - The main data form now uses %z. - The code now conforms to RFC 8536 for early timestamps. - Support POSIX.1-2024, which removes asctime_r and ctime_r. - Assume POSIX.2-1992 or later for shell scripts. - SUPPORT_C89 now defaults to 1. - Include two upstream patches for month names as in April vs Apr. - Update to tzdata-2026c (RHEL-194098) - Alberta moved to permanent -06 on 2026-06-18. - Morocco moves to permanent +00 on 2026-09-20. - Update to tzdata-2026b (RHEL-170784) - British Columbia’s 2026-03-08 spring forward is expected to be its last transition as it moves to permanent -07. - Update to tzdata-2026a (RHEL-154025) - Correct the transition times for Moldova. - The POSIXRULES option is now obsolete. - Update to tzdata-2025c (RHEL-135158) - Update leap seconds file expiration date - Included NEWS file with docs. (RHEL-105043) - Update to tzdata-2025b (RHEL-84741) - Chile's Aysén Region moves from -04/-03 to -03 year-round, diverging from America/Santiago and creating a new zone America/Coyhaique. Update to tzdata-2025a (RHEL-74308) - Paraguay is now permanently at -03. This impacts timestamps starting on 2025-03-22. - Includes improvements to pre-1991 data for the Philippines. - Etc/Unknown is now reserved. - Don't use -source 1.6 and -target 1.6 with javac. (RHEL-70308) - Harden against links to removed zones (RHEL-60063) - Update to tzdata-2024b - Improve historical data for Mexico, Mongolia, and Portugal. - System V names are now obsolescent. - The main data form now uses %z. - The code now conforms to RFC 8536 for early timestamps. - Support POSIX.1-2024, which removes asctime_r and ctime_r. - Assume POSIX.2-1992 or later for shell scripts. - SUPPORT_C89 now defaults to 1. - Include two upstream patches for month names as in April vs Apr. - Update to tzdata-2026e (RHEL-262032) - Manitoba moves to permanent -05 on 2026-10-31. - Update to tzdata-2026d (RHEL-262032) - Canada's Northwest Territories moved to permanent -06 on 2026-08-21. - Obsolescent settings like TZ="EST5EDT" now conform better to POSIX. - Update to tzdata-2026c (RHEL-194098) - Alberta moved to permanent -06 on 2026-06-18. - Morocco moves to permanent +00 on 2026-09-20. - Update to tzdata-2026b (RHEL-170784) - British Columbia’s 2026-03-08 spring forward is expected to be its last transition as it moves to permanent -07. - Update to tzdata-2026a (RHEL-154025) - Correct the transition times for Moldova. - The POSIXRULES option is now obsolete. - Update to tzdata-2025c (RHEL-135158) - Update leap seconds file expiration date - Included NEWS file with docs. (RHEL-105043) - Update to tzdata-2025b (RHEL-84741) - Chile's Aysén Region moves from -04/-03 to -03 year-round, diverging from America/Santiago and creating a new zone America/Coyhaique. Update to tzdata-2025a (RHEL-74308) - Paraguay is now permanently at -03. This impacts timestamps starting on 2025-03-22. - Includes improvements to pre-1991 data for the Philippines. - Etc/Unknown is now reserved. - Don't use -source 1.6 and -target 1.6 with javac. (RHEL-70308) - Fix CVE-2026-33278 (RHEL‑177822) Fix CVE-2026-42944 (RHEL-177936) Fix CVE-2026-42959 (RHEL-177797) - Install correct trust anchor source in Image Mode (RHEL-127540) - Switch TLS configuration to follow TLS sockets by crypto-policy again (RHEL-147860) - Change the default of tls-use-system-policy-versions at build-time - Add new root key 38696 (RHEL-77716) - Do not verify root.key in libs (RHEL-64339) - Create root key if missing automatically (RHEL-127540) - Fix RebirthDay Attack (CVE-2025-5994) - Resolves: RHEL-104129 - Fix verification of unbound-control key files - Resolves: RHEL-65396 - Fix regression on update introduced by local-root symlink - Resolves: RHEL-92255 - Prevent unbounded name compression (CVE-2024-8508) - Fix CVE-2026-40622 (RHEL-184840) Fix CVE-2026-44390 (RHEL-186688) Fix CVE-2026-41292 (RHEL-187352) Fix CVE-2026-42534 (RHEL-187095) - Fix CVE-2026-33278 (RHEL-177822) Fix CVE-2026-42944 (RHEL-177936) Fix CVE-2026-42959 (RHEL-177797) - Install correct trust anchor source in Image Mode (RHEL-127540) - Switch TLS configuration to follow TLS sockets by crypto-policy again (RHEL-147860) - Change the default of tls-use-system-policy-versions at build-time - Add new root key 38696 (RHEL-77716) - Do not verify root.key in libs (RHEL-64339) - Create root key if missing automatically (RHEL-127540) - Fix RebirthDay Attack (CVE-2025-5994) - Resolves: RHEL-104129 - Fix verification of unbound-control key files - Resolves: RHEL-65396 - Fix regression on update introduced by local-root symlink - Resolves: RHEL-92255 - Fix CVE-2026-55973 (RHEL-212809) - Backport additional fix from 1.26.0 (CVE-2026-50252) - Fix CVE-2026-50252 (RHEL-243479) - Fix CVE-2026-55973 (RHEL-212809) - Prevent heap corruption during CNAME synthesis (CVE-2026-82717) - Prevent heap buffer overflow when digesting DNSKEY (CVE-2026-81642) - Prevent heap buffer overflow during DNSSEC canonicalization (CVE-2026-81634) - Add unit tests for vulnerabilities too - Backport additional fix from 1.26.0 (CVE-2026-50252) - Fix CVE-2026-50252 (RHEL-243479) - Fix CVE-2026-55973 (RHEL-212809) - Fix CVE-2026-33278 (RHEL‑177822) Fix CVE-2026-42944 (RHEL-177936) Fix CVE-2026-42959 (RHEL-177797) - Install correct trust anchor source in Image Mode (RHEL-127540) - Switch TLS configuration to follow TLS sockets by crypto-policy again (RHEL-147860) - Change the default of tls-use-system-policy-versions at build-time - Add new root key 38696 (RHEL-77716) - Do not verify root.key in libs (RHEL-64339) - Create root key if missing automatically (RHEL-127540) - Fix RebirthDay Attack (CVE-2025-5994) - Resolves: RHEL-104129 - Fix verification of unbound-control key files - Resolves: RHEL-65396 - Fix regression on update introduced by local-root symlink - Resolves: RHEL-92255 - Prevent unbounded name compression (CVE-2024-8508) - Fix CVE-2026-40622 (RHEL-184840) Fix CVE-2026-44390 (RHEL-186688) Fix CVE-2026-41292 (RHEL-187352) Fix CVE-2026-42534 (RHEL-187095) - Fix CVE-2026-33278 (RHEL-177822) Fix CVE-2026-42944 (RHEL-177936) Fix CVE-2026-42959 (RHEL-177797) - Install correct trust anchor source in Image Mode (RHEL-127540) - Switch TLS configuration to follow TLS sockets by crypto-policy again (RHEL-147860) - Change the default of tls-use-system-policy-versions at build-time - Add new root key 38696 (RHEL-77716) - Do not verify root.key in libs (RHEL-64339) - Create root key if missing automatically (RHEL-127540) - Fix RebirthDay Attack (CVE-2025-5994) - Resolves: RHEL-104129 - Fix verification of unbound-control key files - Resolves: RHEL-65396 - Fix regression on update introduced by local-root symlink - Resolves: RHEL-92255 - Fix CVE-2026-55973 (RHEL-212809) - Backport additional fix from 1.26.0 (CVE-2026-50252) - Fix CVE-2026-50252 (RHEL-243479) - Fix CVE-2026-55973 (RHEL-212809) - Prevent heap corruption during CNAME synthesis (CVE-2026-82717) - Prevent heap buffer overflow when digesting DNSKEY (CVE-2026-81642) - Prevent heap buffer overflow during DNSSEC canonicalization (CVE-2026-81634) - Add unit tests for vulnerabilities too - Backport additional fix from 1.26.0 (CVE-2026-50252) - Fix CVE-2026-50252 (RHEL-243479) - Fix CVE-2026-55973 (RHEL-212809) - Fix CVE-2026-33278 (RHEL‑177822) Fix CVE-2026-42944 (RHEL-177936) Fix CVE-2026-42959 (RHEL-177797) - Install correct trust anchor source in Image Mode (RHEL-127540) - Switch TLS configuration to follow TLS sockets by crypto-policy again (RHEL-147860) - Change the default of tls-use-system-policy-versions at build-time - Add new root key 38696 (RHEL-77716) - Do not verify root.key in libs (RHEL-64339) - Create root key if missing automatically (RHEL-127540) - Fix RebirthDay Attack (CVE-2025-5994) - Resolves: RHEL-104129 - Fix verification of unbound-control key files - Resolves: RHEL-65396 - Fix regression on update introduced by local-root symlink - Resolves: RHEL-92255 - Prevent unbounded name compression (CVE-2024-8508) - Fix CVE-2026-40622 (RHEL-184840) Fix CVE-2026-44390 (RHEL-186688) Fix CVE-2026-41292 (RHEL-187352) Fix CVE-2026-42534 (RHEL-187095) - Fix CVE-2026-33278 (RHEL-177822) Fix CVE-2026-42944 (RHEL-177936) Fix CVE-2026-42959 (RHEL-177797) - Install correct trust anchor source in Image Mode (RHEL-127540) - Switch TLS configuration to follow TLS sockets by crypto-policy again (RHEL-147860) - Change the default of tls-use-system-policy-versions at build-time - Add new root key 38696 (RHEL-77716) - Do not verify root.key in libs (RHEL-64339) - Create root key if missing automatically (RHEL-127540) - Fix RebirthDay Attack (CVE-2025-5994) - Resolves: RHEL-104129 - Fix verification of unbound-control key files - Resolves: RHEL-65396 - Fix regression on update introduced by local-root symlink - Resolves: RHEL-92255 - Fix CVE-2026-55973 (RHEL-212809) - Backport additional fix from 1.26.0 (CVE-2026-50252) - Fix CVE-2026-50252 (RHEL-243479) - Fix CVE-2026-55973 (RHEL-212809) - Prevent heap corruption during CNAME synthesis (CVE-2026-82717) - Prevent heap buffer overflow when digesting DNSKEY (CVE-2026-81642) - Prevent heap buffer overflow during DNSSEC canonicalization (CVE-2026-81634) - Add unit tests for vulnerabilities too - Backport additional fix from 1.26.0 (CVE-2026-50252) - Fix CVE-2026-50252 (RHEL-243479) - Fix CVE-2026-55973 (RHEL-212809) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - new upstream release - new upstream release - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Another zipbomb patch (ported from c10s) Related: RHEL-6272 - Allow decompression of some wrongly compressed files Resolves: RHEL-86228 - Fix obscure invalid memory access in zipinfo Resolves: RHEL-60054 - Fix: Unzip Fails on Large Zip Files - Use the patch from Debian dealing with this Resolves: RHEL-45994 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update usb_modeswitch to 2.6.1 - Drop patch1, http://www.draisberghof.de/usb_modeswitch/bb/viewtopic.php?f=2&t=2733 - Drop BR jimtcl-devel, if we don't install dynlink-dispatcher - Use make macros (https://src.fedoraproject.org/rpms/usb_modeswitch/pull-request/1) - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - New 2.6.0 release - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to a new release - Update to 017 Resolves: RHEL-23148 - Update to 015 Resolves: rhbz#2111403 - do not crash when missing action argument (RHEL-90414) - do not (double) free environ as glibc may want to do that (RHEL-76332) - fix static analysis findings (RHEL-27043) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Replace arch-dependent /usr/include/urcu/config.h with arch-independent stub when needed. (bz# 1951223) - Added CI gating tests - Resolves: bz #1951223 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - New upstream release - New upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - fix RHEL-132706 - use sysusers.d for uuidd - fix RHEL-133956 - login-utils: fix setpwnam() buffer use [CVE-2025-14104] - fix RHEL-123527 - mount: improve --all documentation - fix RHEL-123531 - libblkid: use snprintf() instead of sprintf() - fix RHEL-123536 - libfdisk: (dos) fix off-by-one in maximum last sector calculation - fix RHEL-113638 - lscpu: update ARM identifiers - fix RHEL-108386 - libblkid: (jmicron_raid) backport checksum verification - fix RHEL-56354 - lib/timeutils: parse_timestamp: fix second parsing - fix RHEL-56983 - sulogin: fix POSIX locale use - fix RHEL-25559 - more: make sure we have data on stderr - fix RHEL-34165 - lsipc: fix semaphore USED counter - fix RHEL-25265 - libblkid: Check offset in LUKS2 header - fix RHEL-25559 - more: fix poll() use - lscpu: another tests update (RHEL-12783) - lscpu: update tests, follow max freq for scaling (RHEL-12783) - fix RHEL-16048 - uninitialized memory in SCM_CREDENTIALS in logger(1) - fix RHEL-21257 - logger sending process start time not current time with log messages - fix RHEL-16071 - issues in libblkid - fix RHEL-12783 - lscpu -e doesn't show the current real frequency value - fix RHEL-14612 - Userspace mount options are not preserved for NFS - fix RHEL-132706 - use sysusers.d for uuidd - fix RHEL-133956 - login-utils: fix setpwnam() buffer use [CVE-2025-14104] - fix RHEL-123527 - mount: improve --all documentation - fix RHEL-123531 - libblkid: use snprintf() instead of sprintf() - fix RHEL-123536 - libfdisk: (dos) fix off-by-one in maximum last sector calculation - fix RHEL-113638 - lscpu: update ARM identifiers - fix RHEL-108386 - libblkid: (jmicron_raid) backport checksum verification - fix RHEL-56354 - lib/timeutils: parse_timestamp: fix second parsing - fix RHEL-56983 - sulogin: fix POSIX locale use - fix RHEL-25559 - more: make sure we have data on stderr - fix RHEL-34165 - lsipc: fix semaphore USED counter - fix RHEL-25265 - libblkid: Check offset in LUKS2 header - fix RHEL-25559 - more: fix poll() use - lscpu: another tests update (RHEL-12783) - lscpu: update tests, follow max freq for scaling (RHEL-12783) - fix RHEL-16048 - uninitialized memory in SCM_CREDENTIALS in logger(1) - fix RHEL-21257 - logger sending process start time not current time with log messages - fix RHEL-16071 - issues in libblkid - fix RHEL-12783 - lscpu -e doesn't show the current real frequency value - fix RHEL-14612 - Userspace mount options are not preserved for NFS - fix RHEL-132706 - use sysusers.d for uuidd - fix RHEL-133956 - login-utils: fix setpwnam() buffer use [CVE-2025-14104] - fix RHEL-123527 - mount: improve --all documentation - fix RHEL-123531 - libblkid: use snprintf() instead of sprintf() - fix RHEL-123536 - libfdisk: (dos) fix off-by-one in maximum last sector calculation - fix RHEL-113638 - lscpu: update ARM identifiers - fix RHEL-108386 - libblkid: (jmicron_raid) backport checksum verification - fix RHEL-56354 - lib/timeutils: parse_timestamp: fix second parsing - fix RHEL-56983 - sulogin: fix POSIX locale use - fix RHEL-25559 - more: make sure we have data on stderr - fix RHEL-34165 - lsipc: fix semaphore USED counter - fix RHEL-25265 - libblkid: Check offset in LUKS2 header - fix RHEL-25559 - more: fix poll() use - lscpu: another tests update (RHEL-12783) - lscpu: update tests, follow max freq for scaling (RHEL-12783) - fix RHEL-16048 - uninitialized memory in SCM_CREDENTIALS in logger(1) - fix RHEL-21257 - logger sending process start time not current time with log messages - fix RHEL-16071 - issues in libblkid - fix RHEL-12783 - lscpu -e doesn't show the current real frequency value - fix RHEL-14612 - Userspace mount options are not preserved for NFS - Updated manpages. - Resolves: rhbz#2176778 - Rebased to latest upstream candidate. - Resolves: rhbz#2071648 - Fixed vdostats output issues. - Resolves: rhbz#2004576 - Removed incorrect assumptions about major device numbers in vdostats. - Resolves: rhbz#2045885 - Made improvements to the vdorecover script. - Resolves: rhbz#2047543 - Added a tool to make LVMVDO pools read/write so that support and debugging tools may access them. - Resolves: rhbz#2047543 - Fixed off-by-one issue in vdostats. - Resolves: rhbz#1999056 - Improved error handling and path validation in vdostats. - Resolves: rhbz#2004576 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebased to upstream candidate. - Resolves: rhbz#1955374 - Removed all python based tools, and all management should now be done with LVM. - Resolves: rhbz#1949159 - vdostats is now a C program - Resolves: rhbz#1972302 - Rebased to upstream candidate. - Related: rhbz#1955374 - Updated manpages. - Resolves: rhbz#2176778 - Rebased to latest upstream candidate. - Resolves: rhbz#2071648 - Fixed vdostats output issues. - Resolves: rhbz#2004576 - Removed incorrect assumptions about major device numbers in vdostats. - Resolves: rhbz#2045885 - Made improvements to the vdorecover script. - Resolves: rhbz#2047543 - Added a tool to make LVMVDO pools read/write so that support and debugging tools may access them. - Resolves: rhbz#2047543 - Fixed off-by-one issue in vdostats. - Resolves: rhbz#1999056 - Improved error handling and path validation in vdostats. - Resolves: rhbz#2004576 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebased to upstream candidate. - Resolves: rhbz#1955374 - Removed all python based tools, and all management should now be done with LVM. - Resolves: rhbz#1949159 - vdostats is now a C program - Resolves: rhbz#1972302 - Rebased to upstream candidate. - Related: rhbz#1955374 - patch: Read integrity profile info from top level device. - patch: Fix possible use of uninitialized variable. - patch: Reinstate pbkdf serialization flag in device activation. - patch: Fix LUKS2 device status in inline HW mode and detached header. - patch: Set inline integrity flag if no underlying dm-integrity device. - patch: Fix wrong device size status reports in cryptsetup and integritysetup. - Resolves: RHEL-122297 RHEL-125152 RHEL-125167 RHEL-132585 RHEL-140106 - patch: Improve check for a function attribute support. - Resolves: 100089 - Update to cryptsetup 2.8.1. - Resolves: 100089 - patch: Ignore unknown VMK entry 24 in bitlk metadata. - Resolves: RHEL-94860 - Specbump for correct target release. - Resolves: RHEL-39003 RHEL-41238 - patch: Warn if Argon2 keyslot is unlocked in FIPS mode. - patch: Enable Argon2 in FIPS with openssl backend. - patch: Abort online reencryption for misconfigured devices. - patch: Harden online reencryption checks in initialization phase. - patch: Fix detection of direct-io with suspended devices. - patch: Return suspended status also for unknow target types. - patch: Do not handle device as suspended on error. - Resolves: RHEL-39003 RHEL-41238 - Update to cryptsetup 2.7.2 - Use OpenSLL Argon implementation instead of the built-in one - Resolves: RHEL-32377 - RHEL-186659 CVE-2026-47162 vim: code injection via NetrwBookHistSave() - RHEL-186646 CVE-2026-52858 vim: possible code execution with python3complete - RHEL-185874 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin - RHEL-178243 CVE-2026-46483 vim: command injection in tar plugin - CVE-2026-41411 vim: Command injection via backticks in tag files - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass - Resolves: RHEL-164966 vim: arbitrary command execution via modeline sandbox bypass - Related: RHEL-159630 rebuild to build with exception target - remove -O0 from flags - RHEL-159630 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function - RHEL-203985 CVE-2026-59858 vim: arbitrary Ex command execution in C omni-completion - RHEL-201197 CVE-2026-59856 vim: potential command execution in PHP omni-completion - RHEL-191367 CVE-2026-57455 vim: Out-of-bounds write with soundfold() - RHEL-192113 CVE-2026-57456 vim: possible code execution with python complete via crafted docstrings - RHEL-194062 CVE-2026-55693 vim: out-of-bounds write in tree_count_words() and sug_filltree() - RHEL-186659 CVE-2026-47162 vim: code injection via NetrwBookHistSave() - RHEL-186646 CVE-2026-52858 vim: possible code execution with python3complete - RHEL-185874 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin - RHEL-178243 CVE-2026-46483 vim: command injection in tar plugin - CVE-2026-41411 vim: Command injection via backticks in tag files - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass - Resolves: RHEL-164966 vim: arbitrary command execution via modeline sandbox bypass - RHEL-253669 CVE-2026-28420 vim: buffer overflow in terminal emulator - RHEL-215664 CVE-2026-55892 vim: stack out-of-bounds write in dump_prefixes() - RHEL-215684 CVE-2026-59857 vim: stack out-of-bounds write in spell_soundfold_sal() - RHEL-215659 CVE-2026-52859 vim: out-of-bounds read in update_snapshot() - RHEL-244500 CVE-2026-73077 vim: arbitrary code execution via keyword lookup in zsh.vim ftplugin - RHEL-242475 CVE-2026-73072 vim: heap buffer overflow in set_sofo() - RHEL-240370 CVE-2026-73078 vim: code injection in netrw via bookmarks - RHEL-242114 CVE-2026-73076 vim: code execution via .VimballRecord file - RHEL-203985 CVE-2026-59858 vim: arbitrary Ex command execution in C omni-completion - RHEL-201197 CVE-2026-59856 vim: potential command execution in PHP omni-completion - RHEL-191367 CVE-2026-57455 vim: Out-of-bounds write with soundfold() - RHEL-192113 CVE-2026-57456 vim: possible code execution with python complete via crafted docstrings - RHEL-271037 vim: ex command injection via crafted filename in sign_jump() - RHEL-257027 CVE-2026-73073 vim: arbitrary Ex command execution during C omni-completion via crafted typeref - RHEL-253669 CVE-2026-28420 vim: buffer overflow in terminal emulator - RHEL-215664 CVE-2026-55892 vim: stack out-of-bounds write in dump_prefixes() - RHEL-215684 CVE-2026-59857 vim: stack out-of-bounds write in spell_soundfold_sal() - RHEL-215659 CVE-2026-52859 vim: out-of-bounds read in update_snapshot() - RHEL-244500 CVE-2026-73077 vim: arbitrary code execution via keyword lookup in zsh.vim ftplugin - RHEL-242475 CVE-2026-73072 vim: heap buffer overflow in set_sofo() - RHEL-240370 CVE-2026-73078 vim: code injection in netrw via bookmarks - RHEL-242114 CVE-2026-73076 vim: code execution via .VimballRecord file - Resolves: RHEL-164966 vim: arbitrary command execution via modeline sandbox bypass - Related: RHEL-159630 rebuild to build with exception target - remove -O0 from flags - RHEL-159630 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function - RHEL-155438 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin - RHEL-155423 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file - RHEL-147941 CVE-2026-25749 vim: Heap Overflow in Vim - RHEL-143726 sudo not able to spawn "vi" command when NOEXEC is used to prevent escaping to shell - RHEL-112005 CVE-2025-53905 vim: Vim path traversial - RHEL-112009 CVE-2025-53906 vim: Vim path traversal - RHEL-2159 vim: Heap Use After Free in function ins_compl_get_exp in vim/vim - RHEL-40602 CVE-2021-3903 vim: heap-based buffer overflow vulnerability - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass - Resolves: RHEL-164966 vim: arbitrary command execution via modeline sandbox bypass - Related: RHEL-159630 rebuild to build with exception target - remove -O0 from flags - RHEL-159630 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function - RHEL-155438 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin - RHEL-155423 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file - RHEL-147941 CVE-2026-25749 vim: Heap Overflow in Vim - RHEL-143726 sudo not able to spawn "vi" command when NOEXEC is used to prevent escaping to shell - RHEL-112005 CVE-2025-53905 vim: Vim path traversial - RHEL-112009 CVE-2025-53906 vim: Vim path traversal - RHEL-2159 vim: Heap Use After Free in function ins_compl_get_exp in vim/vim - CVE-2026-41411 vim: Command injection via backticks in tag files - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass - Resolves: RHEL-164966 vim: arbitrary command execution via modeline sandbox bypass - Related: RHEL-159630 rebuild to build with exception target - remove -O0 from flags - RHEL-159630 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function - RHEL-155438 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin - RHEL-155423 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file - RHEL-147941 CVE-2026-25749 vim: Heap Overflow in Vim - RHEL-143726 sudo not able to spawn "vi" command when NOEXEC is used to prevent escaping to shell - RHEL-112005 CVE-2025-53905 vim: Vim path traversial - RHEL-112009 CVE-2025-53906 vim: Vim path traversal - RHEL-186659 CVE-2026-47162 vim: code injection via NetrwBookHistSave() - RHEL-186646 CVE-2026-52858 vim: possible code execution with python3complete - RHEL-185874 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin - RHEL-178243 CVE-2026-46483 vim: command injection in tar plugin - CVE-2026-41411 vim: Command injection via backticks in tag files - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass - Resolves: RHEL-164966 vim: arbitrary command execution via modeline sandbox bypass - Related: RHEL-159630 rebuild to build with exception target - remove -O0 from flags - RHEL-159630 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function - RHEL-203985 CVE-2026-59858 vim: arbitrary Ex command execution in C omni-completion - RHEL-201197 CVE-2026-59856 vim: potential command execution in PHP omni-completion - RHEL-191367 CVE-2026-57455 vim: Out-of-bounds write with soundfold() - RHEL-192113 CVE-2026-57456 vim: possible code execution with python complete via crafted docstrings - RHEL-194062 CVE-2026-55693 vim: out-of-bounds write in tree_count_words() and sug_filltree() - RHEL-186659 CVE-2026-47162 vim: code injection via NetrwBookHistSave() - RHEL-186646 CVE-2026-52858 vim: possible code execution with python3complete - RHEL-185874 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin - RHEL-178243 CVE-2026-46483 vim: command injection in tar plugin - CVE-2026-41411 vim: Command injection via backticks in tag files - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass - Resolves: RHEL-164966 vim: arbitrary command execution via modeline sandbox bypass - RHEL-253669 CVE-2026-28420 vim: buffer overflow in terminal emulator - RHEL-215664 CVE-2026-55892 vim: stack out-of-bounds write in dump_prefixes() - RHEL-215684 CVE-2026-59857 vim: stack out-of-bounds write in spell_soundfold_sal() - RHEL-215659 CVE-2026-52859 vim: out-of-bounds read in update_snapshot() - RHEL-244500 CVE-2026-73077 vim: arbitrary code execution via keyword lookup in zsh.vim ftplugin - RHEL-242475 CVE-2026-73072 vim: heap buffer overflow in set_sofo() - RHEL-240370 CVE-2026-73078 vim: code injection in netrw via bookmarks - RHEL-242114 CVE-2026-73076 vim: code execution via .VimballRecord file - RHEL-203985 CVE-2026-59858 vim: arbitrary Ex command execution in C omni-completion - RHEL-201197 CVE-2026-59856 vim: potential command execution in PHP omni-completion - RHEL-191367 CVE-2026-57455 vim: Out-of-bounds write with soundfold() - RHEL-192113 CVE-2026-57456 vim: possible code execution with python complete via crafted docstrings - RHEL-271037 vim: ex command injection via crafted filename in sign_jump() - RHEL-257027 CVE-2026-73073 vim: arbitrary Ex command execution during C omni-completion via crafted typeref - RHEL-253669 CVE-2026-28420 vim: buffer overflow in terminal emulator - RHEL-215664 CVE-2026-55892 vim: stack out-of-bounds write in dump_prefixes() - RHEL-215684 CVE-2026-59857 vim: stack out-of-bounds write in spell_soundfold_sal() - RHEL-215659 CVE-2026-52859 vim: out-of-bounds read in update_snapshot() - RHEL-244500 CVE-2026-73077 vim: arbitrary code execution via keyword lookup in zsh.vim ftplugin - RHEL-242475 CVE-2026-73072 vim: heap buffer overflow in set_sofo() - RHEL-240370 CVE-2026-73078 vim: code injection in netrw via bookmarks - RHEL-242114 CVE-2026-73076 vim: code execution via .VimballRecord file - Resolves: RHEL-164966 vim: arbitrary command execution via modeline sandbox bypass - Related: RHEL-159630 rebuild to build with exception target - remove -O0 from flags - RHEL-159630 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function - RHEL-155438 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin - RHEL-155423 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file - RHEL-147941 CVE-2026-25749 vim: Heap Overflow in Vim - RHEL-143726 sudo not able to spawn "vi" command when NOEXEC is used to prevent escaping to shell - RHEL-112005 CVE-2025-53905 vim: Vim path traversial - RHEL-112009 CVE-2025-53906 vim: Vim path traversal - RHEL-2159 vim: Heap Use After Free in function ins_compl_get_exp in vim/vim - RHEL-40602 CVE-2021-3903 vim: heap-based buffer overflow vulnerability - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass - Resolves: RHEL-164966 vim: arbitrary command execution via modeline sandbox bypass - Related: RHEL-159630 rebuild to build with exception target - remove -O0 from flags - RHEL-159630 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function - RHEL-155438 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin - RHEL-155423 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file - RHEL-147941 CVE-2026-25749 vim: Heap Overflow in Vim - RHEL-143726 sudo not able to spawn "vi" command when NOEXEC is used to prevent escaping to shell - RHEL-112005 CVE-2025-53905 vim: Vim path traversial - RHEL-112009 CVE-2025-53906 vim: Vim path traversal - RHEL-2159 vim: Heap Use After Free in function ins_compl_get_exp in vim/vim - CVE-2026-41411 vim: Command injection via backticks in tag files - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass - Resolves: RHEL-164966 vim: arbitrary command execution via modeline sandbox bypass - Related: RHEL-159630 rebuild to build with exception target - remove -O0 from flags - RHEL-159630 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function - RHEL-155438 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin - RHEL-155423 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file - RHEL-147941 CVE-2026-25749 vim: Heap Overflow in Vim - RHEL-143726 sudo not able to spawn "vi" command when NOEXEC is used to prevent escaping to shell - RHEL-112005 CVE-2025-53905 vim: Vim path traversial - RHEL-112009 CVE-2025-53906 vim: Vim path traversal - Rebase to Fedora Rawhide - Enable virt-what to detect WSL2 resolves: RHEL-89793 - Rebase to Fedora Rawhide resolves: RHEL-56807 - Implement virt-what-cvm for s390x related: RHEL-50659 - Add virt-what-cvm tool resolves: RHEL-50659 - Add support for Azure VMs on ARM resolves: RHEL-45834 - Add support for CRI-O containers resolves: rhbz#2218203 - Don't match Nutanix-based baremetal systems resolves: rhbz#2211980 - Add a check to ensure that /proc/$$/exe can be read thanks to mbliss@redhat.com for the report and the proposed patch Resolves: RHEL-101066 - Update to version 2025.10.07 from upstream - Resolves: RHEL-145607 - Update to version 2024.01.23 from upstream - Resolves: RHEL-33980 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Enable CONFIG_IEEE80211BE (RHEL-10237) - Update to upstream version 2.11 (plus a follow-up backport) Resolves: RHEL-10237, RHEL-58725 - Support macsec HW offload. Resolves: RHEL-22440 - Backport fix for PEAP client (CVE-2023-52160) - update BRs (#1933647) - updated to 4.0ga14 (#1922848) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - updated to 4.0ga13 (#1911117) - updated to 4.0ga12 (#1882956) - updated to 4.0ga11 (#1869461) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - updated to 4.0ga10 (#1860639) - updated to 4.0ga9 (#1840492) - updated to 3.6ga12 (#1823121) - update BRs (#1933647) - updated to 4.0ga14 (#1922848) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - updated to 4.0ga13 (#1911117) - updated to 4.0ga12 (#1882956) - updated to 4.0ga11 (#1869461) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - updated to 4.0ga10 (#1860639) - updated to 4.0ga9 (#1840492) - updated to 3.6ga12 (#1823121) - xfsdump/xfsrestore: suggest recovery for false roots may be possible using -x - Related: RHEL-8000 - xfsdump: restoring inventory prevents non-directory files being restored from tape, - actually fixed by rebase to 3.1.12 - related: bz#2166557 - xfsrestore: Files from the backup go to orphanage dir because of xfsdump issue - related: bz#2034327 - rebuilt, Fix wrongly associated bugzilla Related: rhbz#2181660 - New upstream release - Use Cem's pgp key instead of Eric's Related: rhbz#2181660 - New upstream release - Resolve issue with bind mounts / root inode mismatch (#2034324) - xfs unrepairable filesystem if directory block not junked in phase 3 - more - fixes - Related: RHEL-54342 - xfs unrepairable filesystem if directory block not junked in phase 3 - Related: RHEL-54342 - Fix missing rpm db entry for: /usr/share/xfsprogs - Related: RHEL-39450 - xfs_repair: allow symlinks with short remote targets - Related: RHEL-54306 and RHEL-53164 - Fix coverity issue - Related: RHEL-39449 - Following is the patch list: - xfsprogs-6.5.0-xfs.8-xfs-fix-bounds-check-in-xfs_defer_agfl_block.patch - Fix various CVE issues. - Related: RHEL-32996 - Following is the patch list: - xfsprogs-6.5.0-xfs_db.xfs.8-xfs_db-fix-leak-in-flist_find_ftyp.patch - xfsprogs-6.5.0-xfs_repair.xfs.8-xfs_repair-make-duration-take-time_t.patch - xfsprogs-6.5.0-xfs_repair.xfs.8-xfs_scrub-don-t-call-phase_end-if-phase_rusage-was-n.patch - xfsprogs-6.5.0-xfs_fsr.xfs.8-xfs_fsr-convert-fsrallfs-to-use-time_t-instead-of-in.patch - xfsprogs-6.5.0-xfs_fsr.xfs.8-xfs_fsr-replace-atoi-with-strtol.patch - xfsprogs-6.5.0-xfs_db.xfs.8-xfs_db-add-helper-for-flist_find_type-for-clearer-fi.patch - xfsprogs-6.5.0-xfs_repair.xfs.8-xfs_repair-catch-strtol-errors.patch - xfsprogs-rhelonly-xfs_db-fix-unitialized-variable-in-check_parents-function.patch - Rebase to a more recent upstream release - Related: RHEL-28339 - Following is a list of dropped backported patches which - are contained in the current rebase: - xfsprogs-6.4.0-set-bnobt-cntbt-numrecs-correctly-when-formattin.patch - xfsprogs-6.4.0-mkfs-fix-man-s-default-value-for-sparse-option.patch - xfsprogs-6.4.0-xfs_repair-don-t-add-junked-entries-to-the-rebuilt-d.patch - xfsprogs-6.4.0-xfs_repair-fix-messaging-when-fixing-imap-due-to-spa.patch - xfsprogs-6.4.0-xfs_repair-don-t-spray-correcting-imap-all-by-itself.patch - xfsprogs-6.4.0-xfs_repair-fix-messaging-when-shortform_dir2_junk-is.patch - xfsprogs-6.4.0-xfs_db-move-obfuscate_name-assertion-to-callers.patch - xfsprogs-6.4.0-xfs_db-fix-metadump-name-obfuscation-for-ascii-ci-fi.patch - xfsprogs-6.4.0-xfs-stabilize-the-dirent-name-transformation-functio.patch - - Rename xfs_quota-fix-missing-mount-point-warning.patch to reflect upstream - version it was merged in. - Rebase to upstream version 6.3.0 - - Following is a list of dropped backported patches which - are contained in the current rebase: - xfsprogs-5.19.0-xfs-hoist-refcount-record-merge-predicates.patch (v6.2.0) - xfsprogs-5.19.0-xfs_db-fix-dir3-block-magic-check.patch (v6.1.0) - xfsprogs-5.19.0-xfs-estimate-post-merge-refcounts-correctly.patch (v6.2.0) - xfsprogs-5.19.0-xfs-get-rid-of-assert-from-xfs_btree_islastblock.patch (v6.2.0) - xfsprogs-5.19.0-xfs-fix-off-by-one-error-in-xfs_btree_space_to_heigh.patch (v6.2.0) - xfsprogs-5.19.0-xfs-fix-sb-write-verify-for-lazysbcount.patch (v6.1.0) - xfsprogs-5.19.0-xfs-removed-useless-condition-in-function-xfs_attr_n.patch (v6.0.0) - xfsprogs-5.19.0-xfs_repair-retain-superblock-buffer-to-avoid-write-h.patch (v6.1.0) - - Rename the remaining patches so the name contains upstream version in which - they are implemented, or "rhelonly". - - Drop Eric Sandeen's public key used to check tarball signature and replace it by - Carlos Maiolino's (current upstream xfsprogs maintainer). - - Following is a list of newly backported patches from versions released after 6.3 - which are fixing patches present in version 6.3: - xfsprogs-6.4.0-xfs_repair-don-t-add-junked-entries-to-the-rebuilt-d.patch - xfsprogs-6.4.0-xfs_repair-don-t-spray-correcting-imap-all-by-itself.patch - xfsprogs-6.4.0-xfs_repair-fix-messaging-when-fixing-imap-due-to-spa.patch - xfsprogs-6.4.0-xfs_repair-fix-messaging-when-shortform_dir2_junk-is.patch - - Backport: - xfsprogs-6.4.0-xfs_db-move-obfuscate_name-assertion-to-callers.patch - xfsprogs-6.4.0-xfs_db-fix-metadump-name-obfuscation-for-ascii-ci-fi.patch - xfsprogs-6.4.0-xfs-stabilize-the-dirent-name-transformation-functio.patch - to implement RHEL-RHEL-8284 - - Backport xfsprogs-rhelonly-xfs_quota-fix-missing-mount-point-warning.patch - to implement RHEL-7900 - - Related: RHEL-15399 - Related: RHEL-8284 - Related: RHEL-7900 - Fix man page, mkfs.xfs(8): Update section on dax+reflink - compatibility (#2226900) - Fix man page default for sparse mkfs option (#2216118) - Fix arbitrary file write vulnerability Resolves: CVE-2022-1271 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Enabled CET for i686 (#1910368) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fix location of German man pages (RHBZ#1844813). - Fix: a buffer overflow in lzma_index_append() - Add test for the issue above (needs a special build config to actually fail -> does not fail in our environment) - Resolves: CVE-2026-34743 - Fix arbitrary file write vulnerability Resolves: CVE-2022-1271 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Enabled CET for i686 (#1910368) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fix location of German man pages (RHBZ#1844813). - Fix: a buffer overflow in lzma_index_append() - Add test for the issue above (needs a special build config to actually fail -> does not fail in our environment) - Resolves: CVE-2026-34743 - Added patch for almalinux bugtracker - bootc: unlock only if /usr is read-only (RHEL-138512) - autoremove: when a dangling protected dependency is found produce a wanrning and skip it (RHEL-76112) - automatic: Expand email_to in command_email emitter to individual arguments (RHEL-94321) - Introduce $releasever_major, $releasever_minor variables, shell-style variable substitution (RHEL-65817) - Mark transient transactions in DNF history (RHEL-84512) - Warn/disallow changes outside /usr, /etc with --transient (RHEL-84499) - man page: don't mark mandatory option parameters as optional (RHEL-63958) - Add dnf4 provides and symlink /usr/bin/dnf4 -> /usr/bin/dnf-3 (RHEL-82310) - usage help: don't mark mandatory option parameters as optional (RHEL-63958) - package: remote_location() takes basedir into account (RHEL-71125) - Multisig: ignore untrusted signatures if there is trusted one (RHEL-145372) - Document that local packages are not affected by versionlock (RHEL-94014) - Rename dnf4-multisig(8) manual page to dnf-multisig(8) (RHEL-117134) - Fix importing OpenPGPv6 keys (RHEL-114424) - Add multisig plugin (RHEL-100157) - reposync: Avoid multiple downloads of duplicate packages (RHEL-64320) - Fix bogus changelog entry date - Add forgotten changelog - Backport patch: "dnf copr enable" on "Asahi Fedora Linux Remix" guesses (RHEL-56143) - needs-restarting: Get boot time from systemd UnitsLoadStartTimestamp (RHEL-14900) - reposync: Respect --norepopath with --metadata-path (RHEL-40914) - Fix the annocheck issus from 3-0-33 without reintroducing the regression from 3.0-34 Related: rhbz#2162688 - Fix the regression introduced in 3.0-33 that caused some of the zip build flags to be dropped Resolves: rhbz#2162688 - Disable the asm implementation of some functions and use the C instead - This should fix some of the annocheck issues Related: rhbz#2044902 - Enable gating tests Related: rhbz#2049738 - Add the missing linker flags - Add the patch that allows to configure the linker flags from the spec file Resolves: rhbz #2044902 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Fix the Crash in zlib deflateBound() function on s390x - Resolves: BZ#2193044 - Fix covscan issue CWE-681 - Resolve fuzzing issue for unknown memory access - Rebased Power 8 optimization patches - Fix for Unnecessary IFUNC resolver for crc32_z - Fix for python3.11 broken libxml2 and lxml on s390x - Inflate small window optimization for IBM z15 rhbz#2154775 - Fix for IBM strm.adler rhbz#2134074 - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c - Resolves: CVE-2022-37434 - Fix CVE-2018-25032 Resolves: CVE-2018-25032 - Fix for IBM compressBound() rhbz#2056899 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - do not perform PROMPT_SUBST evaluation on %F/%K arguments (CVE-2021-45444) - Overwrite PROMPT only if it's set to the built-in default (#2026749) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - complete file arguments after rpmbuild -r/-b/-t - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - update to latest upstream release - Rebase to 1.5.5 Resolves: RHEL-62221